>>shkkmo+(OP)
It's true that they didn't mandate detecting and blocking accesses from VPNs, if the user chooses to connect through one. However, they pretty clearly are saying that the application
should be exposed to the public Internet, which is the opposite of what enriquto claimed[0] earlier in this thread:
> As I understand it, this sentence says that the application should be safe even if it was exposed to the public internet, not that it needs to be exposed.
[0] https://news.ycombinator.com/item?id=30103558