There’s a “hub” mode where your endpoint inside the network grants access to the whole network like a standard VPN server.

A VPN is only as much of a security improvement as the service behind it. If it gets installed in a shady way, how much trust can you put into the service?

Not that unusual depending on the software. A lot of them honour the TTL literally.

One enterprise software I know that does it is VMware vcenter. I’m sure there’s plenty of consumer software that retries excessively.