A provisioner must configure every IPSec tunnel. Configuring a single IPSec tunnel is not such a problem, but the time required to bring up a VPN increases dramatically as the size of the network grows. Fully meshed networks are the worst case. It would take days to configure the 21-node network in the example above. Supporting and troubleshooting this type of network could also be difficult for a service provider.
Security is yet another consideration.
Every CPE is accessible to the public Internet and relies on IPSec tunnels to securely transmit data between sites. Therefore, every CPE device must have security measures in place, such as a firewall, to protect every location. Every firewall would need to be opened to allow provisioners access to the devices, which in itself can be a security risk. The management of each firewall becomes very difficult as the network grows in size. Imagine a VPN with 100 nodes.