And when it doesn't (which is often the case behind NAT), you're at the mercy of their relays which are not particularly fast.

As someone who previously led development of a commercial VPN system, I assure you, there are about 100 ways for a VPN to go slower than the network hosting it. Unfortunately.

Two cases I can think of are MTU misconfigurations and constrained CPU on either endpoint, where the node CPU can handle non-VPN network demands but can't handle the VPN demand.