I feel like throwing everything behind a VPN and pretending it is secure is a crux.
Several famous break-ins over the last ten years have hypothetically been on the inside of that wall.
Better to isolate services from each other limiting cross service jumping, than to build security around a single point of failure.
I'm sure in general Microsoft would love to scrap VB in Excel but there's too many companies that run entire areas of business on it, or the whole business itself.
It is the typical legacy/back compat problem. Python or even Powershell would be a vast improvement, but you're going against billions in sunk cost/skills/knowledge.
VB.Net was slowly losing popularity, VB in Excel isn't.