How do these VPNs achieve per-app tunneling?

Question

I want to redirect traffic to specific network interfaces by application on Windows. This is commonly known as "split-tunneling" and a lot of people often do this to selectively send traffic, for example, through a VPN.

There are a few answers in SuperUser which suggest:

1. "SOCKSifying" apps without SOCKS support using software such as Proxifier
2. Using software such as ForceBindIP to force applications to use a specific interface
3. Employing some restrictions based on the destination ip or domain
4. Using a VM
5. Using network interface metrics
6. Blocking app traffic with firewall

You can find most of these suggestions by looking at answers in these questions:

• Disable VPN for a given process/application
• Can I route programs to two internet connections simultaneously in Windows 7?
• How can I direct specific traffic through a given network connection?

All of these approaches either are too hacky (e.g. ForceBindIP injects information in DLLs) or do not achieve the goal of per-app tunneling (e.g. filtering by destination IP is not useful).

In general, there doesn't seem to be an official way to achieve this functionality.

Nonetheless, I've noticed that certain VPN vendors offer this feature (usually they call it white/black listing applications). How do they achieve this? Do they use something like their own implementation of ForceBindIP?

Some VPNs that allow per-app split-tunneling on Windows: ProtonVPN and PureVPN. Furthermore, it seems that ProtonVPN does create a new network adapter for the VPN, so they must have a way to routing app-specific traffic through that interface.

Finally, if it's of any help (or further confusion), Windows documentation illustrate a way to achieve this but it's through the usage of VPN profiles and MDM.