Exactly. We use a VPN to connect to anything somewhat important, and anything truly important requires manual access and approvals. I’m in a pretty senior dev position, and if I lost my laptop:

1. they’d have to break my password or biometric login (disk is encrypted) - with this they get access to most of our code, but no secrets
2. they’d need to hack my phone to access any internal documentation or test environments due to 2FA
3. they’d need to hack my password manager to access anything non-documentation - code repos, prod logs, etc
4. they’d need to hack someone else’s machine to get access to actual prod data, which is probably what they really want

And I’m not doing anything special here (and I’m certainly not a security professional), that’s everyone’s machines due to company policy. We also don’t handle anything particularly sensitive, the most sensitive thing I have is proprietary algorithms, and we’d sue anyone if we suspected they stole our code.

Oh, and if they try to run something sus, it’ll send a report to our IT dept. I actually got contacted by our IT dept because I ran something unfamiliar (I really like my CLI tools), so they added an exception after personally verifying with me that it’s not a hack.

We have teams across the globe, both inside the org and outside, and we haven’t had any issues with security, and we do regular audits. Our security team isn’t particularly special either, I’m sure many other companies have much tighter security than we do.