I just finished doing some install automation with Ansible of the ProtonVPN ovpn configs and I’m happy to report that these settings were not in there.
Not very surprising. I'd imagine it not being very common to find ovpn configs that both allow user-defined scripts and not require any authentication. This post should be a warning for any VPN services that -don't- let you look at the configs you're using.
AFAIK it is not possible to use a configuration file without being able to look at it, am I missing something?
I think some of the free VPN services may hardcode/import a configuration so your settings areessentially baked in. Your only option is to start and stop the VPN, and maybe change the server location.
In that case you're already running code from them so what's the difference if the "exploit" is in the script or the app.