It shouldn't be. Treat the network as public, require credentials for any access whether it comes from inside or outside.

With work from home the security perimeter is the machine. All networks are untrusted.

Correct. Company wifi is just like any other network. Why would there be any services on it that don't use encryption and authentication?

In the context of this thread - how many startups do you think strictly adhere to best practices?

In this context, almost all of them? The whole concept of a "secure network" is very enterprisey