I'd like to know how that exemption would even work in practice. Many politicians happily use WhatsApp etc. on their personal devices with no VPN for official business.

Maybe when they see private conversations with their colleagues being leaked because someone stupidly used their personal account, they'll see the light.