Putting everything behind a VPN is useless if i give people who routinely click phishing links (then ask me for help when/if they realize their mistake, that's how I know) access to said VPN