The problem here is that Orbot is built as a network proxy, rather than a VPN service, and Android does not expose any APIs for raw proxying of network packets.
Per the Orbot description on F-Droid:
Orbot allows access to Tor by accessing a local SOCKS or HTTP proxy. On a rooted device, the proxying can be completely transparent i.e. the app that accesses the network need not be aware of the proxy's existence.
The important distinction here is that Orbot is acting as a proxy, not a VPN. Therefore, it has two options for routing application traffic:
- Work on an app-by-app basis, with the user setting up proxy settings on each app they want to run through Orbot. No root needed for that, since each app will appropriately route its own traffic to Orbot.
- Work system-wide by re-routing all network traffic.
Android doesn't provide any APIs for accessing or re-routing arbitrary network traffic because this would of course be insecure. Therefore, Orbot must resort to using
iptables firewall rules instead, which requires root access. A VPN app, on the other hand, is able to leverage the
VpnService API to construct a VPN connection.
The main difference here is that the system is deeply involved in the creation and management of a VPN connection, even when it is initialized by a third-party application. The user must still approve the connection and the system provides a notification and information dialogs that (in theory, anyway) cannot be hidden or tampered with. The system is also responsible for setting up the virtual network interface that's used for the tunnel.
I am not entirely privy to the Tor protocol, so it could be that acting as a proxy is the only feasible solution at this time. If that is the case, then they simply cannot avoid the root requirement for system-wide routing.