They may make it so it’s user land tools don’t exist, as that is the case on iOS you cannot configure pfctl. As for jail breaking that isn’t going to work on any remotely modern device and certainly something a VPN provider can’t depend on.
They expressly say in TN3165: Packet Filter is not API
It is not considered API. Do not use Packet Filter in a software product that you distribute to a wide audience. If you’re currently shipping software that relies on Packet Filter, plan to migrate to Network Extension.
Then elaborate in Moving off packet filter and then in Test during the transition.
Apple doesn’t tend to announce things too much ahead, but I wouldn’t be surprised if it disappears in the next few years.