[Quarrel]

Indeed, I think this is the correct take.

If they'd done their VPN/dirty work in a linux VM/container, with the VPN running in that, they'd have been fine.

Clean-them would have had their GDID on their normal ISP IP or equivalent, and Dirty-them would have had everything through the VPN from their no-telemetry dirty-host.