Yeah the whole "run local http server as control panel" is iffy for non security centric stuff, let alone VPN software.

I guess it is because it's easy ? But now even windows can make unix sockets, that seems like reasonably easy and secure solution for "talk with some daemon portably"