It is not. At least, not in the usual environmentally destructive sense that people tend to mean by PoW. The idea behind VDFs is that they can only be compute

It is not. At least, not in the usual environmentally destructive sense that people tend to mean by PoW. The idea behind VDFs is that they can only be computed in a single-threaded fashion, so you don't gain any benefit from computing them on giant server farms. This is the exact opposite of PoW which is designed to be computable massively in parallel. In this context, of course, not benefiting from giant server farms is good, because it means people won't wreck the environment to compute them. The tradeoff is fundamental: because VDFs don't benefit from throwing computational resources at them, there is no disadvantage to computing a bunch of them in parallel. So if you had bad intentions from the getgo (and you had a majority of stake at the time), you could still secretly compute a fake bad chain starting at time t, and then release an alternative at time t+n that was as long or longer than the real chain; the security they provide is that if someone compromises your keys later (after you already lost your majority), they can't do this. Since in practice proof of stake chains start very centralized and then distribute over time, this is a useful practical thing to care about! With PoW, on the other hand, computing a fake chain requires you to not use all your hashpower, which opens you up to economic attacks from someone else who is willing to use that hashpower. When someone uses more hashpower than you were, they'll be able to make a longer chain faster (before the difficulty readjusts again), so now all your secret chains have been made useless (and in cases of equal chain length, people tiebreak by hashpower, so you can't just maintain a little side network that eventually catches up when hashpower decreases, either). That's the theory, anyway: it's heavily based on economic incentives, so if some government decided that they didn't really care about the economics and just wanted to screw over chain users by pumping out hashpower, they could do so quite easily. Note that by contrast, proof of stake is not susceptible to this: you actually do have to compromise a majority of the active stakers no matter how much money you have. Personally, I think this is a distinction without a difference because I don't think any cryptocurency can stand up to sustained attacks by large nation-states (which is part of why I don't think it's very useful). But like I said, that's an assessment of the threat model, so it's subjective and up to you to decide.