There are plenty of reports that this happens and at least as of a couple years ago wasn't even that uncommon. Including CCC talks. People want to do remote maintenance, and apparently not everyone has a good enough internal IT to put this traffic on a VPN