Actually not really sure what I said which was not accurate?
I didnt mention the limitation that theres a slot for only one of these VPN / "fake VPN" apps for each profile (work or user), which can be occupied by an app which then controls network traffic from just that user. But that didnt feel relevant.
It is however possible to have a "fake-VPN" app, which is occupying the slot handle traffic and then forward it on through a VPN. Just that has to be done via apps that support this method of operation.
eg. apps such as Netguard and Invizible Pro can be run in the VPN slot and support sending all their outbound traffic via SOCKS5.
There are also VPN apps, which dont need to occupy the android VPN slot, which can receive network traffic via SOCKS5 and route that onto a remote VPN. The wiki on Invizible Pro github has an example of such a setup.