[tatersolid]

Your LAN is protected Only if you know that no workstation which connects via VPN, WiFi, or cable can ever be compromised elsewhere and then connect. Which is clearly not possible unless your workstations are air-gapped and immobile, with no USB ports, etc.

The majority of non-trivial breaches involve some sort of pivot or lateral movement inside the "protected" LAN. These often originate from a workstation.