Comment by xp84

This rings extremely true. The good part about it is, unless there's some kind of exceptional factor (e.g. the app.companyname . com cookie using a cookie scoped unwisely to companyname . com), they can go right ahead and do that and while they might get the corpsite homepage pwned and redirected to penis-pill scam sites or something, any truly dangerous actor who gets a foothold there can't do jack shit in terms of actually compromising your valuable data, getting source code, stealing app sessions, etc because that server is not just outside the VPC, it's in a completely different cloud account somewhere far away.