Replacement TCP/IP stack sounds like a VPN—which iOS allows

VPN is not a replacement TCP/IP stack. I literally meant the TCP/IP stack in the XNU kernel. It might be an esoteric example but it's not that far off. DMA already forced Apple to open up browser engine layer so third-parties can now bring in their own browser engines in the EU and are not restricted to using just WebKit.