Works as expected with the kink that non-VPC traffic is also routed through one of the (random) segments that your lambda has access to. So you'll have to hack something like a proxy together if the lambda needs access to a private segment but also requires non-VPC access.