@JayJay , flighty_sloth is correct. There's no traffic tunneling in this VPN. When the VPN is started, it just creates a new networking interface, tun0 (can be seen in nmap software on android), which is used to access my local network remotely. The routing table isn't affected at all, other than facilitating the connection to the subnet of tun0.
So, no, they're not detecting IPs. They just detect it through Android's interfaces, which is why I'd love for GrapheneOS to block such apps from knowing whether I'm using a VPN. It's none of their business (whether I'm tunneling or not). The only reason this can be done is because of how restrictive Android is.
The browser isn't good enough, btw. The app is used to authenticate access in other devices.
The funny thing is that if I want to tunnel the connection, they can't really stop me. A $100 GL iNet router can do that and they won't detect it except from the IP address... so there's no point in detecting whether I'm running a VPN in the OS. Like I said, it's just a bunch of IT people and developers who don't know what they're doing.