The part that confused me but cleared up now

type = types.submodule ./vpn.nix

So the manual does say:
https://nixos.org/manual/nixos/unstable/#sec-option-types-submodule

types.submodule o

    A set of sub options o. o can be an attribute set, a function returning an attribute set, or a path to a file containing such a value

So that's why passing a path is fine, I suspect the vpn.nix could contain either a function like it did in the example or just an attribute set.
I tried to figure it out from reading the source but that's bit hard for my nix level.