Exactly, it's not a dichotomy. But the first point doesn't present it at one - it doesn't claim that VPN is not useful for defense in depth, only that it's not the solution.

The counterpoint is the one that sets it up as a dichotomy of sorts - that you don't need regulations, because the things that you can do on your own are sufficient.