Good practice in general to not trust your internal network.

The head security guy where I worked 20 years ago was already saying this.

I have to say your head security guy was way ahead of the curve.

Anywhere I’ve worked it was firewall everything and use VPNs, and most places still do this. SFTP was in the too hard basket. And of course that led to people emailing files around as standard practice (and the only option) and inevitably some got emailed to the wrong recipients.