Agreed, this seems more like a timing/correlation type of attack (or threat). Assuming that the same company has the ability to change the firmware on these home routers (your isp lets say), it seems to me it would be much easier for that company to just look at the same timing data on the ISP‘s own routers. (Ie customer IP address 24.3.1.7 has maintained a unusually long session with public IP address 70.4.1.8, which is a known VPN server/ vpn provider , thus that customer must be using a VPN).

Or even taking it a step further that customers IP address is communicating with known VPN server ports (or if port 443 is being used for vpn comms , then back to the original premise of the long sessions / packet counts to a single public IP address = vpn is being used.)