My point was you can side-load apps. As for that specific API even the official docs seem a bit confused:
"Except when you use the NEHotspotHelper class, you do not need to obtain entitlements from Apple to use Network Extension classes. However, you still need to enable the Network Extension entitlement via the Developer portal."