It seems absolutely bonkers that they have such strict requirements for what you plug in, while allowing you to work from home.
That means you will be using your own internet connection and router, which is probably the most vulnerable part of the system, even when using a company installed VPN. And they simply cannot tell if you are doing things like taking photographs of the screens.
They do make a big deal of personal qualities like integrity. They acknowledge they can't control home working but they rely on personal awareness and integrity.
Then again you can't access the higher levels of sensitive documents except for wired desktops in certain areas on site. I guess the proprietary documents but not sensitive or higher. Seriously there's laws that apply from several countries that apply to these matters. It's heavy handed and they can't guarantee everything but there's good reasons behind all this. Not that I really have access to the serious documents and records because my job doesn't currently require it. That could change and the result would be more days on site in certain high security areas to handle them.
VPN isn't necessarily that secure but the only access I have via it is on the lower security servers. A bit of higher security is on other systems I have VPN based system access to but there's extra training and security checks to do that. Still relying on my integrity, which I think I still have enough of.
I am, as you probably realise, keeping a lot from you for probably obvious reasons. I do struggle with knowing what I can and can't say at times. There's a lot I won't say here but I do say a bit more when for example with family even extended family or friends. One on one conversation or trusted ppl. If in doubt I leave it out but Iam not perfect at that.
I simply don't see it as heavy handed rules just likely unenforceable rules. I am mostly a rule keeper than a rule breaker though.