I raised a case, see attached pic. It's a cosmetic issue, meaning the inbound vpn rules shouldn't be there at all. At least until they fix it. The pic is a extract from a document supplied to me by the TAC. I did notice (just now) a ! hover which states this but its much more discrete than the pic. Have asked for a ETA on fix.
Wish the problem was inversed though, would much rather limiting inbound initiated coms from a semi-trusted VPN peer.
Cheers