This post claims otherwise: https://news.ycombinator.com/item?id=14880751
"Except when you use the NEHotspotHelper class, you do not need to obtain entitlements from Apple to use Network Extension classes. However, you still need to enable the Network Extension entitlement via the Developer portal."
They're merely handing out breadcrumbs to give the appearance of a way out which they can retract at any time.