Even your are using VDI in your company, if your BYOD laptop infected virus, since your laptop are using split tunnel to Internet and SSL connect to your VDI farm. The attacker still able to use the comprised laptop as a jump host to attack your VDI farm no matter your VDI farm only open 443 port with VPN tunnel protection.
Even you already enable different security policy on the BYOD laptop such as check patch level, antivirus definition, is it the antivirus is running etc... it still able to be comprised with being detected. If you have SASE solution, you will able to detect the BYOD laptop outgoing traffic to find out the attacker.
