In a day and age were attackers scan the whole Internet for vulnerabilities the smallest amount of motivation can lead to an attack. Expertise is also easier to come by now a days. By using standards protocols instead of proprietary ones we actually make it easier for the attacks to gain expertise. But we do so in the hopes that the openly reviewed standard will actually be more secure than the proprietary one. This is the old full disclosure vs security through obscurity trade-off.
Resources are cheap and plentiful.
What we are left with is opportunity. A VPN by its very nature makes access easier - for both the good guys and the bad guys. A VPN increases the opportunity for attack and the number of attackers that may do so. Any computer connected to the Internet is a likely source of attack and an attacker can easily and cheaply be connected to the Internet. The lack of strong accounting and auditing of most Internet resources means that tracking the source of Internet attacks is difficult thus allowing an attacker to minimize his risk.