Those VPN apps install a root cert don't they? That's a huge security hazard and likely why Apple is putting their foot down on it.

It's not marketing - Apple goes out of their way to build privacy into their products. For example, the way that Apple Maps has no persistent user identifier and prevents Apple from knowing your location history.

Regarding ad-blocking VPNs, I can see why one might be sad to lose these and disagree with Apple's move here. But it's not a privacy decision - it's an ad-blocking decision. VPNs actually focused on privacy, like privateinternetaccess, aren't being removed from the App Store.

I've never been able to take seriously the argument that anything Apple is "just marketing", and I'm not about to now.