MacBook data not routed through iPhone VPN when connected via hotspot

Because that is the correct and expected behavior, and is required by many mobile carriers. Many of them measure and bill hotspot data usage separately from that of the device itself.

Only data originating from the iPhone is routed through the VPN.

To add to the above: If you need to connect to your employers secure network using a VPN, connect to the phone's hotspot, then us the VPN client on your Mac to connect to the VPN and your corporate network.

If you're using a VPN to access the public internet, thinking it is doing something to protect your privacy or secure your data, you're mistaken. it is doing exactly the opposite.

https://www.nbcnews.com/news/amp/rcna211903

Your VPN could be giving your browsing data to China, watchdog says

A new report says 17 VPN apps that are available on Google’s and Apple’s app stores have undisclosed ties to China.

KiltedTim wrote:

If you're using a VPN to access the public internet, thinking it is doing something to protect your privacy or secure your data, you're mistaken. it is doing exactly the opposite.

Correct. There is no security provided, it has just been a marketing ploy similar to AntiVirus companies claiming that they are protecting your Apple devices. Along with the data breaches exposing the data of millions of Americans and the logging occurring where the users information is being sold to advertisers, you are exposing your data to the VPN provider. Unfortunately you find many ads that unsurprisingly claim security benefits and the articles posted on websites are usually notated as "Sponsored Content", so they were paid to include the story.

• https://gist.github.com/joepie91/5a9909939e6ce7d09e29
• https://overengineer.dev/blog/2019/04/08/very-precarious-narrative/

There is one purpose for a VPN, and that is to "tunnel" into a work or school network where usually that corporation provides the settings/product to use for that connection. Every VPN company has now exploited this legitimate use to claim security improvements for all as a much larger revenue source instead of the very limited use case.