VPN is what a smart person uses when they are at an internet cafe or somewhere else with public internet where you can’t trust that the traffic isn’t sniffed by someone for giggles and your bank credentials are going to leak.
* By default, only secure connections are allowed
* You have to enumerate allowed exceptions to this policy in your app manifest XML / Info.plist
* Exceptions are only permitted for specific use cases where mandatory encryption is infeasible, like browsers, podcast players, embedded device clients (which will also require the local network access permission), etc. If you're shipping a banking app and you exempt your own site from encryption, App Review will tear you a new one.
Like, suppose I want to send a physical letter to my bank. I can either ensure it can't be opened (using TLS), or I can get a trusted mailman to bring it to the mail central (using a VPN or trused ISP), but only one of those measures are going to protect me against a malicious mailman carrying it from the mail central to the bank.
Because banks famously love spending time and money on IT security... Anyway, if TLS was broken, that would be a big problem for everybody.
Using a VPN to protect against a zero-day in TLS, is sort of like hoarding gold to prepare for a collapse of society, in that it's a very unlikely scenario, and if it actually were to happen you'd have a bunch of other problems that aren't solved by gold / a VPN.