VPN tunnels that go over port 443 SSL are difficult to throttle w/o affecting other services. They'd have to throttle by destination address, which can be more complex when available VPN endpoints are geographically distributed.