I am saying this attack works only because a client is installed on the device, and that client is malicious. If there was a standard client such as openvpn cli

I am saying this attack works only because a client is installed on the device, and that client is malicious. If there was a standard client such as openvpn client (open source) then this attack will not be possible. That is becasue, the vpn provider will not have any means of using the user's device to send arbitrary network packets to any server to launch a ddos.