Re: Wasn't "But we had to have SMB for our internal shares on the network" the NHS problem?
Home user with badly configured PC. Gets infected.
Connects to work over VPN - SMB shares correctly configured, but infection spreads from PC.
Surely a familar scenario for many remote workers?