I mean as long as we don't offer any VPN configuration in the installer we
could just disable VPN in connman-configuration (disable-vpn?) in the
installation image.

What doesn't get loaded can't break either :P