How should F's three-step modernisation be judged overall, and which points remain the most critical?

Question

Accepted Answer

It lets F keep working with its legacy system over modern access paths. The protection is limited by the outdated technology still in use, but the extensions followed a sound rule: the less secure the environment, the more securable and up to date the systems used there. The most critical points left are user authentication and endpoint security.

* Each step outwards meets a less trusted environment with a more modern, better-protected technology. *
Read the design from the inside out: the oldest protocol (fclient) runs only inside the data centre; the office network sees ICA, a more modern protocol with no application data on the client; the internet sees only HTTPS through a gateway with strong authentication. Exposure and technology grow together. In the end the security architecture is a perimeter with gateway access.
What is left is what no perimeter can solve: if an attacker logs in with a stolen identity, or controls the home PC that displays the desktop, the gateway lets them through as a legitimate user. Strong authentication and the security of the end devices therefore have to be secured separately.
Go deeper:

Multi-factor authentication — Wikipedia — the stronger login a remote-access gateway should require.
 NCSC — Device security guidance — securing the end devices that remote users work from.
 Endpoint security — Wikipedia — protecting the client side that the gateway has to trust.