In my opinion repairability should extend to the ability for the owner of a device to side-load any software.
If apple wants to police their own app-store, fine. But they shouldn't be allowed to exclude installation through other means. If they had not complete control over the ecosystem then they would not be in the situation where they can and have to play deputy sheriff for the government.
"Except when you use the NEHotspotHelper class, you do not need to obtain entitlements from Apple to use Network Extension classes. However, you still need to enable the Network Extension entitlement via the Developer portal."
They're merely handing out breadcrumbs to give the appearance of a way out which they can retract at any time.