We use the described setup at our company and the VPN software (Viscosity) auto connects so seamlessly that you never really need to do anything manually. Works really well.

You think it works well, but it often creates it's own network performance problems.

Basically every big corp uses always on VPNs and it works fine. You can even do stuff over group policy on Windows to get the VPN configured and auto join enabled.

Really? I've worked at a couple large bay area companies this wasn't true.

Security or ultimate convenience, choose up to one.

I suspect "not very secure but pretty inconvenient" is the most popular choice!

Like cycling passwords every 90 days.

If I could go back in time and prevent one "best practice" from being created, it probably would be this one.

Would you care to elaborate? I worked pretty closely with the Corporate IT folks at that company for 6 years and never heard of any issues from them nor complaints from non-tech users in the organization. This company had over 15,000 employees, not the largest but not small.