My org tried to avoid this by not having devices connect to USB or any other wifi except your corporate phone which is locked down. Our system won’t connect outside of the LAN so you would need to compromise the corporate phone or steal one or something, or otherwise compromise the VPN somehow I guess? I’m not in security so idk too many of the details.