Help me out here.. Am I not thinking about this right?

My wife started a new work from home job. They gave her a laptop.

Right off the bat she started noticing the internet was super slow on her work laptop... both wired and wireless. Our plan with our ISP is 1gbps download and 40mbps upload. All our other computers on our home network are getting around 980mbps download and 38mpbs upload, but the highest speed test I could get on her laptop was 20mbps download and 2mbps upload (wired).

I messed around with the computer and found that it has Malwarebytes on it, and it has the VPN enabled and it's connecting to a VPN server across the country. I turned off the VPN and the speeds on that laptop went up to all our other computer's internet speeds (980mbps download & 38mpbs upload). Perfect! Problem solved.

Well.. last week her work's IT department had to remotely connect to the laptop to install some software. They noticed the Malwarebytes VPN was turned off and they turned it back on and told my wife the VPN had to be turned on because it was required by their Cyber Security Insurance... but turning on the Malwarebytes VPN slows the internet down to where the computer is basically unusable.

Now I don't know much about Cyber Security. But, I think I know enough to be dangerous. My thinking is Malwarebyte's VPN is not the type of VPN the Cyber Security Insurance is looking for... they want a VPN connection to the company's network so the company can control network security, right? Not just a random program's VPN that's not securing anything, right?