I'm glad you brought up security

Every enterprise should be concerned about security and their mobile devices. I've been in the security field for a while and I think threats from mobile devices are one of the biggest threats enterprises face today.
But enough of that, let's get to your question:
I know many companies like yours, and I work for one that's likely even more strict about security. The bottom line is that your current GoodLink implementation doesn't go through your existing corporate VPN solution either. Your handset talks to the Good NOC via an encrypted channel, and the Good server inside your enterprise also talks to the Good NOC via an encrypted channel. Both devices stay in contact with the Good NOC and that's how notifications of new messages, calendar entries, contacts, etc get back and forth to your phone. You use your corporate ActiveDirectory credentials (the username and password you use to log in to your computer at work) to authenticate. While this communication channel is encrypted, it is not traveling within your existing corporate VPN solution.
In the Exchange ActiveSync scenario, your handset communicates directly with your companies Exchange front end via an encrypted SSL channel. This is a secure tunnel just like in the Good scenario, but without the middle man NOC and the other middle man Good server. In this case you also use your Active Directory credentials to authenticate. While this communication channel is encrypted and secure just like in the Good example above, it also does not use your existing corporate VPN solution.
Since we're on this topic though, there is a corporate VPN solution that can be used to access Exchange ActiveSync from mobile handhelds within your corporate VPN solution. It also adds additional security features (which neither Good or the default ActiveSync solutions can provide) like compliance checking, security policy enforcement, centralized management, etc. If your IT or security people are interested have them drop me an e-mail and I'll be glad to help.
Norm