The term "tunnels through" is just a layman's simplified explanation. You could google how a VPN works for the longer, more precise explanation if you wish. But, unless you have a "rooted" device (another simplified term) then you cannot be certain that your device is secure, and even then most people are not capable of knowing if it is rooted. The easiest method is using a portable secure hardware VPN hotspot that you carry with you and sits between you and whatever WiFi you are using, be it work, friends, public, etc. It stops people snooping on you, or what you are doing with various means that you can goole also.
I have a HooToo device, as I have stated in other comments. It is also a private access point and media-sharing or streaming gadget. The one I have, the Titan, also has a portable battery that is quite useful at times.
Sent from my SM-P900 using Tapatalk