I really wish people would understand that VPNs are not magical, unbreakable security. VPNs are barely security at all, and commercial VPNs even less so.
The fact that there is no option so that any webview by default opens in safari across all app in ios is horrible.
i am not surprised it is riddled with security holes.