Yes, the restriction to a single VPN client is annoying.
Blocking ad/telemetry domains can be done by adding Adguards DNS servers in the OS settings. Sadly blocking apps Internet permissions completely is not possible (except on OS like LineageOS, CalyxOS or GrapheneOS).
I remember taking my first selfhosting/Linux steps a year or so after the launch of Let's Encrypt with a Pi 3. At the time, most tutorials didn't set up https at all, and if they did, they were self signed certificates (resulting in browser warnings).
Self-signed certificates are annoying and creating them was a series of copy pasting long, weird commands, usually using long exspiration dates (manual renewing sucks).
Not long after, guides started recommending certbot. Nowadays reverse proxys like caddy set up TLS automatically.
At least that's how I remember it, given my complete lack of knowledge about Linux at the time.