You've identified the main risks:
You're contacting a foreign host/network.
It is very easy to create a reverse tunnel using SSH (so the remote party can get to you)
(3. Communication stream is encrypted) ... my additional risk.
With regards to LAN vs. DMZ. Well.. of course, it all depends. On some LANs there might be more inspection with regards to outbound connects (?). I mean, it really depends on your own setup, policies, etc.
Anytime you have "trusted" going to "non-trusted" (no matter what zone), you have the risks already mentioned. Encrypting the traffic doesn't really matter as much, though it can often times confuse the issue (makes people forget that whole "trusted" going to "non-trusted" issue).
But, "are you supposed to do this?"
You effectively said "no", but again, it all depends. The Internet is essentially a public trusted network. We use it because it's there. Not because it provides safety. Thus, by definition, by default, it's certainly in the "untrusted" category for most companies. But maybe we get enough benefit to mitigate (perception wise) the risks (??).
Firewall wise, btw, when an connection is initiated from the company (trusted) to the outside (untrusted), it is very difficult to "block" any nastiness. And because the communication is encrypted, I'd say it is very very very difficult.