Ditto VPN vulnerabilities. Belt and suspenders can help though if a remote is compromised likely all the things it uses will be, if not immediately then eventually.

Hell I’ve seen 30 days. Sometimes they are using a third-party - it still should be almost immediate these days.

Fraud. It takes a while for them to receive the funds even though they are charged against your account almost instantly.