The reason was easy integration with PostgreSQL over PAM. I will check if the same could be achieved with Wireguard. Technically, already deployed devices can switch to other VPN tunnel, so there is nothing preventing us from the change.