To answer the questions of how traffic is being routed. . . I sniffed the traffic going over my wifi and back to the Tesla.
When I opened up the iPhone app and it queried the car, all traffic went over OpenVPN back to a Tesla owned IP address.
When I browsed sites in my Tesla, they were going out over HTTP/HTTPS traffic - NOT through the VPN. So Tesla is doing what I would expect - any communications they do with the car is over the VPN, any web browsing is not. I saw a TON of Google traffic, which is probably exactly that - the Google traffic displayed on the screen. Also not over the VPN.