What would it mean if they weren't? Does every business have to put every internal service on the public Internet or else?

This is really good news and part of the verdict may also prove valuable in the fight for privacy rights and against chat control.

Both courts of the CJEU have shown again and again not to fear ruling against nations and EU institutions and by extension move the European project forward unlike the four political institutions (Commission, both Councils and Parliament). They also actually seem to know what they're talking about.

In the fight against chat control I had partial faith in Parliament until Metsola started torturing the rules and manufactured an outcome last week. I do still have faith in the courts and I think, hope, ultimately that's where this fight will be won.

I give it 1 year until the title says VPNs are illegal.

This ruling states that using a VPN to access content which is public domain in one jurisdiction but copyright protected in another is legal and not the responsibility of the VPN provider or the site providing the content.

But does it apply to activity by users on VPNs like torrenting of copyright protected material?

Lawful Neutral.