Will the new changes to Android 9 cause the VPN based firewall apps become obsolete?

Question

Firewall apps use VPN to manage network (to allow or disallow apps to connect to the Internet via Wifi or Mobile Data), mainly is for phones that are not rooted.

However, this article mentions:

As XDA Developers explains, access to proc/net is going to be tightened up so that only designated VPN apps will be allowed to read TCP and UDP files (and in turn interpret network activity).

Even though I support that Android should have features to allow or disallow Apps to have Internet access, BUT this wonderful feature may not even applies to Android or Google apps itself. (Such as the data hungry Google Play Store and Google Play Services apps!)

Thus, if only designated VPN apps are allowed, this means that phones which are not rooted will no longer be able to use Firewall apps that use VPN to manage network! This is totally unacceptable!

If Android 9 (Android Pie) do not allow end-user to be able to control the network for the famous and notoriously data hungry Google Play Store and Google Play Services apps (that self update without permission from end-user), then it implies that Google and Android have fail the city by disregarding end-user's concern on network usage!

Therefore, I would like to know if Android 9 will result in such unfair and despicable behaviors.

Answer 1

Have a read of the commit on googlesource here. It states

Files in /proc/net leak information. This change is the first step in determining which files apps may use, whitelisting benign access, and otherwise removing access while providing safe alternative APIs.

[....]

• Labels /proc/net/{tcp,tcp6,udp,udp6} as proc_net_vpn due to existing use by VPN apps. This may be replaced by an alternative API.
• Audits all other proc/net access for apps.

Answer 2

I'm not a developer but I can try to put a simple picture of this scenario. The purpose behind restricting apps' access to /proc/net is to make sure that VPN apps should no longer be able to detect when other apps connect/disconnect to/from internet. It's justified as it was a security flaw. VPN apps have been accessing these files to detect device's network activity, which is possible through proper Android APIs. And that only designated VPN apps will be allowed to read TCP and UDP files was just for Pie release, giving some grace period to developers of VPN apps.
On Android Q:

Android Q removes access to /proc/net, which includes information about a device's network state. Apps that need access to this information, such as VPNs, should refer to the NetworkStatsManager and ConnectivityManager classes.

Coming to your concern:

it implies that Google and Android have fail the city by disregarding end-user's concern on network usage!

As quoted in my answer to one of your other questions, firewall apps which are based on VPN have become somewhat privacy protections apps just as a side effect of Android's VPNService API which wasn't intended for this usage. Such apps can do app filtering based on UIDs and/or SOcket_MARKs which Android uses to categorize the network traffic for different purposes. If they wanted to give users freedom of choosing which apps can access internet and which can't, they could simply set Protection Level of android.permission.INTERNET dangerous, but it doesn't favor their business model.

Consider the fact that Google is biggest search engine and ads are their prime source of revenue. Android is a world of targeted advertisement through online tracking and profiling, though no doubt they try to protect user's privacy and security from certain aspects. Device is yours, you must be given the right to restrict connectivity of even the daemons running as root. But it's not the case. That's why advanced users who want a more fine-grained control on privacy, usually root their devices and make use of lower level things like Linux kernel's builtin firewall iptables. Going further deeper there are mods like Xposed to Android core framework. Android's hidden permission manger AppOps is also helpful from certain aspects. Also some custom ROM have such features built-in, so that no third party firewalls are required: