In my opinion, risks are low in this case, unless we start making suspicions on the people involved in the project about insider trading.
I see a potential risk in information exfiltration made by a rogue project member that leverages the VPN's encrypted traffic to access some resource at the IT company (e.g. storage) to later retrieve it (probably the employee will be able to access the same VPN from home).
But since the people on the project are limited in number, it's not my choice to make suspects upon them. Maybe they are trusted enough.
Or if the VPN, as in my comment, also allows for Internet access, different evil may happen. Suppose none of the users are insider traders (rogue), if the VPN allows for internet you are at minimum giving up on antivirus protection from proxy, unless the IT company protects the VPN with a restrictive proxy/filter. This is why you should talk with
WellKnown LLC to make sure they block general internet access, of course unless it's really really fundamental for the project.
As you said, you are using Cisco AnyConnect. That is a tool widely used on the market, and as any tool, it shall be installed from trusted source and by verifying the author's digital signature, which is something Windows is good at.
The risk of the AnyConnect binary to be tampered with is negligible unless the company is enough high-profile. By the way, Govern... (I mean, determined-attacker)-level attacks are often out of the scope of this board because it's basically not possible to defend from a determined attacker with unlimited budget forever. AnyConnect needs Admin privileges and can modify system settings, so that's a tool sensitive enough to use care when being installed on corporate machines.
As a side note, stating that "I don't trust Cisco's AnyConnect because it could do malicious stuff" is like refusing to install MS Windows itself after not having verified its source code (which is the reason why Chinese government owns its customized and vetted MS Windows version: protect from potential US tampering).