What they refer to BYOC is bring your own cloud account for the cluster, while it still connects out to the same shared control plane (and that also connects into your cloud account) that is used for their PaaS offering. At least for BYOC with AWS the connections to the control plane all go over the internet and not via PrivateLink etc.

Since all your metadata and env vars live on the control plane, any issues there could affect the BYOC cluster.

There are some other options for a separate control plane, e.g. now they seem to have the term "forward-deployed control plane" which might be fairly close to what you're thinking of, but their BYOC by itself does not get what you want.