VPN is great for permanent connections to a network that allows this access or if the controller's Gateway is configured, but what about the millions of control systems out there that are not connected to a WAN or cannot be configured with a proper Gateway address.
Say you are an automation programmer that gets an urgent call for a malfunctioning stand alone controller and there is no way in hell the control system will be connected to their office network. The facility has guest WIFI. If you can get anyone with a standard laptop to connect to the controller using the LAN connection and get on the WIFI to access the internet, you can gain access. Even if there no Guest WIFI, cell phone tethering is possible.
Without having to ship a laptop with expensive software, or "N_E_T_B_I_T_E_R" or similar equipment, suck it up and pay for a service that will do this. It's a fraction of the cost for a round trip visit or about the same cost as an overnight package. Most importantly, it can be setup immediately.
Google "remote plc access". There are plenty of options. One of them requires no additional equipment, expensive software, or invasive manipulation of the remote laptop.