I thought Wireguard runs inside the kernel on Android since it ships as part of Linux now.

I think it has to be enabled as a module, and the android kernel has it disabled.

As far as I know, you need root permissions to add an interface. Even though the module is enabled, it's not used.

The official wireguard app also mentions wireguard-go