I'd largely agree (maybe not for the VPN concentrator or an SSH jumpbox), but for many people, it's much easier to set it up once then to set it up and THEN set up port forwarding. For that matter, for the VPN concentrator, unless you're technical enough and have a good enough router to have a separate DMZ network, the advantage to having trivial stuff like SSH jump and VPN on the router is that it means you don't have any incoming insecure ports, and don't need to be as concerned with keeping security patches on inside-the-firewall stuff.