Even if its on the cloud, should be locked behind your VPN
That's certainly one way of thinking. But it's not the only one. It's not even the only secure one