Comment by yjftsjthsd-h

The device running the VPN is still exposed to the attacker-controlled device. Now, on a decently-configured system this is probably fine (your workstation doesn't allow password-based SSH, right?), but it's still not great.