If they start looking into your stuff for any reason, and suspect that a user connected to your site through a VPN, you're in.

It doesn't have to be true to begin with. And it doesn't have to be enforced at scale, only when needed.