As a concrete example: You can configure a policy that will make VLS limit the amount of satoshis that can be sent per unit of time (i.e. the "velocity" of sent payments).

Then if you are integrating the node software in a larger service that has to send out money for any reason, if THAT service is compromised and starts trying to send out as much of your funds as possible, then the VLS policy triggers and stops outgoing transfers beyond the velocity limit you sent. This can at least prevent some losses.

Similarly, if your larger service is compromised and the node happens to have onchain funds, you can set policies that limit what onchain addreses can be sent to, so that the even if the larger service that uses the LN node is compromised, VLS can at least prevent some of the theft attempts.

As for something VLS CANNOT protect you from: you probably want to run some kind of node manager that automatically reopens channels that get closed. If THAT manager is compromised so that it always points your liquidity at specific nodes (and thus distorting the Lightning Network fee market in favor of those nodes) VLS cannot really detect and protect against that. Similarly, if you have policies that would prevent you from interacting with certain nodes, operators, or IP ranges, VLS cannot really prevent your node from connecting out to those, it is ONLY a signer.