Facing the same issue, did u find a solution?

Actually the confusion is caused by iOS 15 referring to apps using Screen Time APIs while iOS 16 refers to per-app on managed devices. The same applies to "Deploying a DNS proxy provider" where iOS 16 seems to say that per app is on managed devices and the rest we can assume to be open. Anyway, we already have an app that does these things in "Packet Tunnel Provider" by using some code in RUST. Thought that the time had come when we could do it straight forward in Swift. Thanks for clarifying. I would suggest that you improve the document to avoid confusion.