Moral of the story is actually to use a VPN regardless of what you do, so you can't be held accountable for someone else's actions or lack of security of IT department of some company.