I do this too yes. It's a great extra level of security though probably not too smart to rely on as the only one.

It's true you're already screwed if they get past the VPN and I also don't set up Auth for stuff that doesn't have any private details. But don't count on just the VPN for sensitive stuff. Like password manager.