Interestingly (I just found this out) Android permits 1 VPN connection per user profile.
So I run a VPN in my regular profile, and found my work profile wasn't using it. So I installed Tailscale there, and it works only in the work profile, while my regular VPN only works in my main profile.
If always assumed VPN config was a system-wide thing.