" If you were doing this then you were effectively impervious to that entire class of attack unless the attackers start on the inside of your network. (which should be guarded against by other access control measures)."
Seriously? Were you found in a cabbage patch this morning?
Even if, by some act of magic, your VPN was perfectly secure, that does close to 0 about one of your users who mistakenly clicked on an ad or clickbait article and now has been rooted.
Your user's machines have been compromised. All of them. For quite some time. Now--explain your security posture with twenty-year old procedures is adequate.
We still are not settled on exactly what should be considered proper MFA. Keeping up is going to matter for a while.
Biting the hand that feeds IT
