Correct, but there are no better non-root alternatives as far as I know. Would love to be proved wrong. There are some workarounds to use NetGuard with a VPN based on a work profile or something, but I haven't personally tried them and cannot attest to them working.