This isn't news, really - folks who actually work with large-scale deployments (and management) of iOS devices (particularly devices with cellular connectivity or which need to access random wifi networks) already know that the only real always-on VPN capability in iOS is IKEv2 pushed via your MDM system of choice. This has been true since the capability was first released in (IIRC) iOS 8. Yes, it's hella-lame Apple buries this information.
FWIW, this capability IS available to individuals using the free Apple Configurator application. The only catch is you'll need a machine running the latest MacOS to run the latest Apple Configurator.
FWIW, this capability IS available to individuals using the free Apple Configurator application. The only catch is you'll need a machine running the latest MacOS to run the latest Apple Configurator.