A researcher disclosed an Android 16 VPN bypass that leaks your real IP. Google declined to patch it, but GrapheneOS shipped a fix within days.