Because that's what connecting a VPN does, by design. It's not a setting you've missed.
Your Mac has a routing table with a default route: where packets go when nothing more specific matches. Normally that's your router. When a VPN client connects, it creates a tunnel interface and points the default route at it. From that moment, every process on the machine that opens a connection follows the new default. Nothing needs to know a VPN exists.
You can watch it happen. Before connecting:
$ netstat -rn -f inet | head -4
default 192.168.1.1 UGScg en0After a normal VPN client connects, that line points at a utun interface instead. That single line is the whole story.
Two different models exist, and the difference matters:
Exclude from a full tunnel. Your Mac still joins the VPN, and specific apps are punched out of it. This is what "split tunneling" usually means in Windows VPN clients, and what SplitTunnel.app does on macOS.
Opt in from a normal connection. Your Mac never joins the VPN at all; individual apps are moved into a tunnel that nothing else uses. This is what VPNonly does. The default route is never touched, so the worst case is one app losing connectivity rather than your whole machine.
Which is better depends on your goal. If you want privacy by default and exceptions for convenience, exclude from a full tunnel. If your Mac is fine as it is and one app needs to be somewhere else, opt in.
Routing and name resolution are separate. An app can have its traffic tunneled while its DNS lookups still go through your normal resolver, which is the case with VPNonly today. For changing an app's exit IP that's fine. For hiding which sites you visit from your ISP, it isn't — use a tool designed for that.
The app’s exact privileged engine source is public and MIT licensed.