What do you want me to say? I'd think it ought to be self-evident that greater risks exist when operating in a single shared memory space at ring 0. If nothing else, the trampoline to privilege is already complete; very little stands between a vulnerability and an active exploit.

The end goal ought to be getting more things out-of-ring 0, not adding more things to it -- I'm never going to say that "I'm not concerned" or that "It's a non-issue" (although I will say that I'm a lot more worried about the massive amounts of crap code in WiFi drivers than I am about a VPN implementation, generally speaking).

In the OpenVPN case, numerous vulnerabilities have been limited to only DoS exploits due to the zealous use of assert(); in the kernel case, that brings down your machine, and quite often, assertions are compiled out of the release kernel due to their overhead in critical paths (whether they should be is another question).

We do have ways to tackle the kernel->userspace performance divide when it comes to packet processing, e.g: https://www.freebsd.org/cgi/man.cgi?query=netmap&sektion=4

  netmap is a framework for extremely fast and efficient packet I/O for
  both userspace and kernel clients. It runs on FreeBSD and Linux, and
  includes VALE, a very fast and modular in-kernel software switch/data-
  plane, and netmap pipes, a shared memory packet transport channel. All
  these are accessed interchangeably with the same API.

  netmap, VALE and netmap pipes are at least one order of magnitude faster
  than standard OS mechanisms (sockets, bpf, tun/tap interfaces, native
  switches, pipes), reaching 14.88 million packets per second (Mpps) with
  much less than one core on a 10 Gbit NIC, about 20 Mpps per core for VALE
  ports, and over 100 Mpps for netmap pipes.

  Userspace clients can dynamically switch NICs into netmap mode and send
  and receive raw packets through memory mapped buffers.  Similarly, VALE
  switch instances and ports, and netmap pipes can be created dynamically,
  providing high speed packet I/O between processes, virtual machines, NICs
  and the host stack.