After Big Sur deprecated network kexts, I switched over to Viscosity-- which is another OpenVPN client, and supports both tun and tap VPNs without an extension (using only built-in macOS capabilities).

It does not require the Network Extension framework, is not App Store distributed, and does not have any entitlements. (It is Developer ID signed and notarized, but that's just for user convenience; it'd work just fine unsigned if the user wanted to click through macOS's warnings to get there.)

Well the Wireguard app exists both for macOS and iOS so I guess is not that big deal to support VPN on these systems.

Also services like this one to circumvent the Apple policy couldn't just give you a Wireguard configuration file and say to you "just install the Wireguard app and import the config"? It would work and of course Apple couldn't do anything (beside removing the whole Wireguard app from the store).