nandohyphen1 If there is an RCE in the Wi-Fi firmware, kernel Wi-Fi drivers, IP stack, etc., all of that is independent of which user profile is active.
If there is an RCE in a specific app, probably that can be reached equally via cellular or Wi-Fi, VPN or not.
User profiles are most straightforwardly a way to insulate apps from other apps, and also to "lock down" some files.