This is actually not quite true. They only installed a signing profile, which still requires a prompt to install each app and wasn't used to do anything but install the research app. The "keys to the kingdom" is the trusted root certificate, which coupled with the VPN, made them your ISP and gave them complete access to all traffic in all apps.