It's possible the machine has some kind of VPN connection and this encryption is indeed end-to-end, just at another layer.

More probably: the branch itself has a hardware VPN, so compromising the local network is still possible.