There's no way it can stay free can it? It seems like a crazily expensive feature for them to bake in..
How would you get a non-privileged executable to take control of full network?
While that's the most common way to run a VPN, it's not the only way. You use TUN/TAP devices because you want arbitrary programs to use them. In this case, you only want Opera to use the VPN connection. You don't need a TUN device for that.
This sounds perfect to me. A custom corporate wrapper for a web browser that lives in its own silo. Workers who are working from home for the day can use that app for work while keeping everything else like Spotify or YouTube or Netflix from going on a long roundabout trip through the VPN. Sounds perfect if you ask me.