Should it be expected that individual users should be familiar with corporate deployment documentation just to know that their VPN app they bought actually leaks?