Start wifi tethering. Connect your VPN, assume traffic is going over it.... nope.
There is a shadow APN configured for your network provider that you can't edit, and all tethered traffic goes over that, not the VPN'd connection.
The VPN only protects traffic originating from the phone.
But variety of applications can install their cert (with ofc user permission via dialog) and snoop traffic. At least unencrypted.
The way they do it is installing vpn and reading stuff in-between
https://play.google.com/store/apps/details?id=app.greyshirts...
AFAICT the reason for this second APN is to allow providers to discriminate between phone-originated data and tethering for charging purposes. And they seem to have persuaded google not to allow people to edit it :/
Turns out that the phone VPN client only covers phone traffic.