Not quite. There’s no VPN tunnel - no IPSec tunnel is being set up, even on loopback. The reason the “VPN” icon appears is because VPN profiles are how you ove

Not quite. There’s no VPN tunnel - no IPSec tunnel is being set up, even on loopback. The reason the “VPN” icon appears is because VPN profiles are how you override iOS network settings on unmanaged devices: which can include just DNS. Any time a profile is ‘active’, the icon appears. You could generate your own unsigned profile to do the same, if you were so inclined.