As long there isn't a critical risk, these kind of business decisions won't aim for certainity.

They probably assume some amount of collateral damage, a small number of VPN users still flying under the radar, the bulk of VPN users being properly targeted, and the vast majority of users not noticing anything.