Privacy on MS Defender iOS with ControlFilter

I am eager to understand more about how the Zero Touch Control Filter method of deploying Defender for iOS to Intune supervised devices affects end user privacy. I note that it does not use the loopback VPN referenced in unsupervised device setups but also that the Control Filter cannot be used alongside a device-wide VPN - does this mean the traffic is being routed elsewhere, I.e the company network? As far as I can see Microsoft have not directly commented on the privacy implications of this kind of setup.