The problem isn’t necessarily “stuff not sent over vpn isn’t encrypted”. Everyone uses TLS. It’s more that you are no longer NATed behind the VPN egress IP. When governments want to assassinate anyone who touches a destination IP, having the true source IP instead of a VPN source IP is pretty helpful. For this to be practical you first need a botnet of compromised home routers… which they already have.

In a corporate environment, traffic that is VPN’d typically also undergoes better logging and deep packet inspection.

“yes, please keep using Jenkins” -every red team ever

EasyCanvas supports a one time payment model but seems to be focused on drawing instead of note taking, and it’s not clear if the files would be stored on the iPad.