There does not seem to be any ban on companies VPNs. They don't need to and that would weaken protection against external attacks.

I think the aim, if I understand it as it is not very clear overall, is rather than government agencies may access the company's infrastructure (VPNs are irrelevant).

> rather than government agencies may access the company's infrastructure

I think the law is closer to "government agencies may access any of the company's information".

My understanding is that the law is that government agencies may access companies' infrastructure to conduct security and compliance audits.

The worry is that this may be used to access companies' data.

China/CCP doesn't care.

Best-case scenario if you want to consolidate power: Dirty westerners blew up our IT industry to maintain dominance!

Look, their debt bubble is ready to pop as-is. The collapse was already inevitable. With the economy slowing down and the trade war, it's going to come fast.

This is how they contain the damage. Plus the party controls the (enormous) population even more closely during the rapid contraction.