Because if it uses the internal VPN feature, EVERY system app can bypass it, and the Captive Portal app and others certainly do.
Only GrapheneOS fixes that afaik, providing their own Servers for captive portal, connectivity check, SUPL proxy server (strips off data and Google still has to manage because monopoly)