Their system, their rules. VPN alone doesn't make a system compliant, unless the client says so. Just as a random thing, imagine if you showed up with a machine that is running your own compiled kernel, with Spectre mitigations disabled. They would never see what hit them.