This seems to be a valid reason to implement certificate pinning in the application's network layer. At least 3rd party VPN providers don't get to intercept without replacing the pin.