E.g. When Joe Employee walks into the office, we know it is him and what he does and where he works. At home, Joe Employee might have a friend who looks over his shoulder at the project launch document he is completing, at the financials that are being submitted to the CFO.
Shopify follows the the zero trust networking/Beyondcorp model, and we never had the physical office spaces as part of our threat model. Not much can be done for shoulder-surfing (aside from privacy screens, and our security training), however we have built out robust systems that build trust modeling out of identity and device security.
The first time it was a little odd, but it's routine for those companies who have sensitive IP.
Bad actors will always be able to get round these controls imo.
Do they handle it? A heck of a lot of companies are using nothing more than remote desktop from personal machines right now.