Because the protection that the VPN provides decreases the risk of having bugs to the point where they won't get prioritized, ever.

That is just bad management, to be fair. Companies need to intentionally increase risks before they can fix them?