If 20% of people are using VPNs, blocking them is going to be a double-digit hit.
Traffic is sent through two independent relays: Apple sees your IP but not the destination, while a 3rd party egress partner sees the destination but not your IP, with encryption preventing either side from correlating both ends. It's some of the benefits of Tor. But of course you still need to put a lot of faith in Apple's implementation, which is the hardest part.
Quite frankly, it's a bit silly to paint Apple as some privacy fortress, who wouldn't have to comply with law enforcement/intelligence to unmask/tap traffic. I mean, for a lot of people VPN choice is done considering legal jurisdictions somewhere far away. Apple could/would never possibly offer this level of protection.
There were also plenty of corp-ware in existence that had Flash as *absolutely mandatory*.