Excellent summary but after all the analysis is complete why then is the obvious conclusion dismissed?

alternative is forcing the companies to invest in a secure vpn or such not.

A vpn is not very hard nor very expensive. ( well.. I'm assuming that the systems aren't too proprietary; but on M$ or *nix they aren't hard.)