L2TP is not very robust in the security area, because it assumes that the security of the remote (and the wire that connects the remote to the gateway) is as good as the corporate network. That can only be true in very limited cases.

There are other security concerns besides the network, as well.

The tunnel endpoints are authenticated in L2TP, but not the packets themselves. Therefore, L2TP can be easily spoofed (thinking that it's talking to an IP address it's not really in communication with) and is vulnerable to MITM attacks.

Denial of Service (DoS) attacks are possible by terminating the underlying PPP connection (or the IP tunnel) by injecting false control messages into the datastream.