N3rdTek yeah I can imagine you would say that and it is understandable.
"Simply Forking GrapheneOS" is not sustainable at all. So I dont see this as a real request.
Including for example the official Wireguard App would neutrally solve this problem, and users could still disable the app.
It is Apache 2.0 licensed btw.
So I dont see GrapheneOS implementing it. At the same time, it may be required for some threat models, or also for for example work phones.
The threat model is not completely clear, as no identifiable data is probably sent over whatever router the attacker would be on that may log the traffic.
The only solution would be allowing another small app into the empty system partition. The disadvantages, apart from maintenance, would be tiny, as people can just disable it.
But the other way around is not possible.
Another option would be allowing to disable safe mode.