1.) the system strictly respects user-configured DNS; and

2.) that the leak of some private data is acceptable. leaked traffic is still leaked even if otherwise encapsulated by some other encryption mechanism outside of an otherwise properly-configured VPN tunnel.

#1 is of course a much larger risk assumption to swallow.