True. Will add, device must be supervised to use VPN always-on which is possibly sensible albeit annoying (would have to reinstall iOS and set up as new I believe).