From user point of view, removing support for kernel extensions is definitely a win, since it means more stable (and secure) system.

IME kernel extensions (kexts) were definitely related to various kernel panics that I've seen in the past.

In most cases, alternative APIs have been present for quite some time, it's just that some software hasn't been upgraded yet. Deprecation started a few years ago, so it's nothing surprising really.

Similar VPN and virtualization apps work without kexts, so I assume both Tunnelblick and VirtualBox could be rewritten to take the leverage of the new APIs.