Tunnelling is useful because it allows you to connect to any other machine on the network. Once you compromise one internal machine, you can use it as a platform for other attacks. Simply installing tools such as nmap on the compromised machine won't allow you much freedom in terms of actually exploring the network, beyond preliminary scans.
Getting a VPN connection on a network is pretty much the holy grail of tunnelling. It's the logical equivalent of actually being connected to that network directly. As such, tools that can't easily be run over a proxy, or on a remote system, can be run with relative ease. Most VPN protocols operate as an abstraction of the link layer, such that arbitrary network protocols can be translated onto the remote network. This is extremely useful for tools like ARP spoofing, where a normal SOCKS proxy won't allow arbitrary packets to be sent across. This makes it very convenient to just fire up your BT5 instance (or whatever pentesting box you're using) and jump right into the network. Furthermore, VPN traffic is encrypted and likely to be completely ignored by a firewall.
Alternatively, you might use a SOCKS proxy or even a Tor hidden service to facilitate your tunnelling needs. These are more limited, due to the level at which they relay traffic, but are easier to set up and easier to customise in order to hide traffic from a firewall / IDS.