Complexity and publicity.

Complexity: Single purpose apps built with a very specific threat model in mind for a boring, established usecase tend to be more secure. K8s is a fast evolving labyrinth of complexity with contributions from thousands of people, very few of whom have a grasp on the whole codebase.

Publicity: the general Internet doesn't find your VPN server just by using your API.

The VPN server offers frivolous features like session tracking, and certificate revocation. Things k8s continues to punt down the road or outright ignore.

Because VPNs are magic that never has a backdoor for a decade.