There’s exactly 1 narrow way that it’s true. Before widespread #WFH, attackers often had an insurmountable barrier: no way into the business network from the Internet. At the last gig (2008) where I had to visit a “workplace” regularly, inbound remote access was officially non-existent & outbound Internet access all went through restrictive web proxies.