i wonder if they are running the proxy for external network connections in the VM.

The cloud instance certainly runs a full mitm proxy. There are complications for that when dealing with logging, but maybe on the desktop it doesn't log, just running a permissions engine.