But probably using their own server, entirely within their own network? I.e. you can't even connect without a VPN?

Not that that protects from backdoors but still.