I think that's a problem with enterprise IT mindset, rather; this idea that there's a binary distinction between inside and outside, trusted and untrusted, and therefore whatever you connect to the network must be vetted because it suddenly has all this trust by default.

I think it's pretty inevitable that the evolution will be in the direction of distrust by default, and internal apps will slowly require more secure programming models, incrementally becoming more like ordinary public-facing sites. The reason is that the trust-by-default (once you're on the "inside") model is too centralized and can't scale to the increased number of devices. Employee devices will need hardening against intrusion from the corporate network just as much as the network needs hardening against intrusion from Bob from accounting; because you stop infections spreading by stopping the vectors for transmission, and that works from both ends.

There is a distinction of trusted and untrusted, but I wasn't implying a trust by default method because that's not good either. I also wasn't trying to imply that a vetted device is necessarily a trusted device. For example, we allow Blackberry, Apple and Android devices on our network as "officially supported" mobile devices. We don't trust them but we know if something goes wrong we can issue a single command and wipe the device which effectively ends all access that device had/has to our network resources.

The point is, and you hit on it, that you have to prevent intrusion, compromise or infection from all places and allowing people to work on their own hardware or without a VPN means that job becomes exponentially more difficult.