[ani-ani]

We're using vague terms, but the point is that controlling the VM is not the same thing as controlling the VM's traffic, especially in the model where your OS is not actually hosting the VM (since Hyper-V is a type 1 hypervisor).

[Rapzid]

I believe my statement holds true for any practical purpose being discussed, and it's particularly aimed at type 1 hypervisors. In a Xen setup you wouldn't say "dom0 doesn't control the vm traffic". It controls the hypervisor. The root partition is the same way in hyper-v:

Root Partition – Manages machine-level functions such as device drivers, power management, and device hot addition/removal. The root (or parent) partition is the only partition that has direct access to physical memory and devices.

It may not automatically send traffic through the windows FW because the networking setup now has traffic on a virtual switch/bridge, but the VPN creators have all the access they would ever need to control the networking from the root partition..