That is a convincing argument. I wasn't thinking of wireguard, but it makes sense that it's quite small and focused, being in the kernel.

I'm dealing more with OpenVPN and that can be very annoying, that had me lean in the opposite direction earlier (and lets not even speak of the Cisco crap).