FWIW, all tethered traffic in GrapheneOS goes through a VPN.