Or maybe it's not so much that the VPN itself would be the security risk, rather, it's the necessary reconfiguration of the router that would cause additional security risks not directly related to the VPN. Depending on the type of router and firewall systems they have in place, it's possible that allowing VPN traffic would require them to disable other protective features.

But if she's just worried about the VPN traffic, the truth is that the company at the other end of the line is at greater risk than the hotel's network.