They also require a paid developer subscription to get access to the Network Extensions capability (needed to build a VPN protocol extension) in order to make sure people who develop these apps can't just provide IPA files for normal users in China to "sideload" using tools such as my Cydia Impactor.