While it wouldn't blanket ban VPNs, a VPN is fairly clearly a "communication technology" and a provider could be targeted by this bill. I'm pretty sure they wouldn't even need to do anything malicious, just be large enough and have some malicious users.
The provider would have to be controlled by China or other designated foreign adversary, and they would indeed have to be doing something determined to be a serious threat to the US.
The provider would be acting to abet the violation of this act. Whether or not they are Chinese doesn't matter in that subsection. If they were Chinese they wouldn't care about a US fine anyways. It's even possible that one would argue that a user using a VPN to access TikTok would be violating the bill.
The bill applies to only to financial transactions ("covered transactions" in the bill) and holdings ("covered holdings"), there's nothing in it at all directly regulating access to data or websites by individuals.
