An analysis focused on VPN data disclosure risks points to a familiar cyber lesson: encryption helps, but metadata, DNS, and route handling still decide how private a connection really is.