Ios does the same, only way around it is if you have an ?enterprise? licence (250+ devices)

Mullvad and others reported on that one ages ago

Is this really true? The Mullvad report a year or so ago was that they didn’t want to turn on no exceptions mode because it breaks network connectivity until reboot if you don’t pause it when updating the app, not that the feature doesn’t exist. They also recently shipped it anyway, opt in and behind a warning.

As a quick chatgpt check and following the links to apple's own site that still seems to be the case...

Force “most” traffic through VPN using includeAllNetworks Yes, but imperfect (normal) Yes (supervision)

stronger controls are tied to device management / supervision, usually for organization-owned devices.

https://developer.apple.com/documentation/NetworkExtension/N...

a VPN enabled wifi router would suffice as a fallback tho right?

You could get one of those hotspots https://www.gl-inet.com/products/gl-mifi/

Haven't bought one (yet - but did quite a bit of research but again outdated by 2 years...)

For the very specific case where you are connected to that router, yes.

MacOS has had instances where their own apps could bypass always-on VPN. I'm not sure if there have been exploits or gaps where traffic could go to arbitrary destinations directly.

this is not an ocassional bug this is still the system design today. privacy gateways upstream of big tech are the way to go on this because privacy isn't their profit center

Terminology like "private" and "trust" differ in meaning from computer land to human convention.

It's a concern to me, because humans often extend their trust to computer trust based upon misunderstanding of the identically spelled words and lack of recognition of differing context.

How hard would it be to fix the system_server (and any other) bypass?