Actually, this is not entirely the case. (Great writeup on the rest of it though.) If you have control over the firewall, it's possible to set it up to allow syncing through. There is a slight security risk in doing this, but it would really depend on someone knowing a lot about your system in order to take advantage of it. But you don't have to pay Mergic, or set up a VPN, to do it.

What you have to do is open a sync port on the firewall. You also have to have one internal IP address mapped to receive the sync from one external IP address. In other words, when a sync request comes in on the sync port from that external IP, the firewall routes the traffic to the internal IP you've given it, which will be your PC. This is a slight challenge if your firewall is doing NAT, or DHCP, which most are, but can be worked around, especially in a small office.

(For our home office, we have one external IP, and two people, and we just change the destination of the remote hotsync, based on who is travelling that week. And we gave the PC's with Palm profiles on them static IP's. For a larger office, you'd probably have more external IP's, and maybe still not too many people wanting to do this, so you might be able to give them each their own in the same way.)