They're not, but the point is that users can see the 403 due to network errors.
If vpn + networking work then the user can access the resource through the private interface. If there are issues with network routing or VPN then they end up on the public interface and get 403.
So from the user perspective the same action can result in success or 403 based on whether there are network issues.