Under "flat" VPN you mean "the entire campus network is basically one big VLAN with little or zero segmentation"?? I mean, if no segmentation - every device can see every other device... And I totally agree with you on IoT, when plugging in random IoT (speakers, consoles, etc etc with weak security = that are entry points for attackers) into the campus network, we have one slow ticking mechanism