In most configurations, it’s trivial to use the os native VPN client, with some minor caveats. This creates a tunnel device and does what 99% of end-users working remotely need.
my point is: on all setups you have traffic that might go around the vpn tunnel, that is an application defect not that ssh tunels are worse.