You may have looked on a bad one.

System-wide blockers on both iOS and Android do use the VPN API, but the idea is to intercept your outgoing traffic on the TUN interface, emulate the TCP/IP stack, and filter it locally, right on your device.

How do you know which one the app is doing? From my perspective the vpn was “on”

The easiest way would be to visit a website like "whatsmyip" and check that your IP address stays the same.

Not perfect, but you could connect to wifi, and look at the connections the phone makes.

Of course, it could change its behavior if it detects a cellular connection...

A better way would be to download the app and reverse engineer the binary.

And do that every single time there’s an update?

or download an open source version on f-droid

Exactly. It's a VPN in name only, and the only reason is to route traffic to be able to bypass the security features in the OS.

They are actually local VPNs looping back to your device. That's the only way to change DNS servers when on cellular data. Until Android P, which will finally allow that.

Would it be possible to skirt these policies by having a system-wide ad blocker that's only partially configured? Either the user has to modify their systems settings to use the local VPN or take some action to load or enable the blocklist.

The ones I have used on Android just use the /etc/hosts file.

Those ones need root. The VPN ones are there to bypass this requirement.