Keep in mind that even with VPN, there are still some very good reasons to choose a Surface Pro--or other Windows 8 Pro tablet--rather than a Surface RT. However, it seems that the functionality of a Windows 8 Pro device will come at a price. The price, features, and capabilities of a Windows 8 Pro tablet will be more equivalent to an ultrabook than rival tablets, so it's not valid to compare a Windows 8 Pro tablet against an iPad, or comparable Android tablets.
The lack of VPN connectivity is not the only issue with the Surface RT. If you're using a Wi-Fi only Surface RT you might need to use a smartphone or cellular-enabled tablet to connect to the Internet. However, the Surface RT seemed incapable of detecting the iPhone 5 personal hotspot as an available wireless network.
This issue is minor, though, for two reasons. First, you can generally find a Starbucks, McDonald's, or some other retail establishment offering a free Wi-Fi network every 200 yards or so. Second, I checked with Microsoft and found that this is a known issue that has to do with how the network is named. Windows RT has a problem with wireless network names that have special characters like the apostrophe. Microsoft has a fix coming soon, but in the meantime you can simply rename your hotspot network to something that works.
As a side note, it might be possible to connect to an AnyConnect VPN using the Windows RT VPN tool. However, doing so might require changes to the configuration and security parameters to allow the Windows RT VPN to negotiate the connection. I'm awaiting additional feedback from both Microsoft and Cisco to further clarify the issue and potential solutions or workarounds.