I don’t understand the scope of VPN on an iPhone

Does a VPN app on your iPhone only work when you’re using a browser, or does it work on all the apps used in an iPhone?

All apps. You could for example use a VPN and the Files app to access fileservers behind a firewall.

https://www.apple.com/uk/legal/privacy/data/en/vpns/

The big Caveat on iPhones

Not all your device’s network traffic will be routed through an active VPN. If an app developer specifies a required type of connection for their app, such as mobile data only, network traffic from that app is excluded in active VPN configurations. On iOS and iPadOS devices, your VPN provider can choose to override this choice and prevent most apps, services, and system functions from routing network traffic outside of an active VPN configuration.

Some traffic necessary for essential system services will not be routed through an active VPN configuration, such as direct connections with your local network’s routers (which are necessary to establish and maintain a network connection), and certain mobile services that only work on mobile networks (which may include Visual Voicemail, where available).

It works on all apps, just remember that apps and websites can also grab location details through gps.

You got Apple Private Relay as a kind of security layer…

A VPN on iOS protects all data in and out, unless you manually create exclusions.

a VPN on the phone covers the entire phone.

Basically any worthwhile VPN won’t allow traffic that isn’t secured by the connection.

Okay, so, if I’m using Apple Music on the iPhone to connect (via Wi-Fi) to my wired Sonos speakers on the LAN, the connection should not go through a VPN, correct? Will iOS stop this from happening?

Literally adding extra scope that doesn’t remotely answer OPs question. Also, that doesn’t do the same as a VPN.

Private Relay is for SAFARI ONLY. That’s it. Nothing else is protected. Nothing. A VPN offers all-transferred-data protection. No exceptions.

That was a useless comment to make. You could have said, “If you’re just concerned about protecting your browser, that’s what Private Relay is for. It doesn’t touch anything outside of the browser. Even though all browsers use Apple’s WebKit, it still specifically protects Safari, and has minimal effect outside of Safari.” That would have been helpful.

I had eggs for breakfast.

And Private Relay is just Cloudflare

Green Eggs and Ham! Surface Air Missile I am!

Sadly it really is a game of Whack-A-Mole with Apple.

https://papers.mathyvanhoef.com/usenix2023-tunnelcrack.pdf