if you are willing to let a vpn client abuse your system, you might also want to set a network interface that routes all traffic to the ssh tunnel. might be trivial to add as a module if not available already.
my point is: on all setups you have traffic that might go around the vpn tunnel, that is an application defect not that ssh tunels are worse.