I mean, from what I've seen, a lot of companies already use wireguard as its base layer, so if this is not secure, the VPN service itself will not be. They could simply offer the user to create a wireguard config and download that, like Mullvad does, which not only would allow users to skip the app, but also allow users to use VPNs only with certain networks and not all, and even allow tunneling if the end user uses a dedicated firewall. That way you could use certain VPN connections for certain addresses/pools and others for other, or even circumvent it in very niche cases, if need be.