Feels like something is broken in the latest firmware for 2862 (3.9.6), as following Draytek's own instructions to the letter (aside from VPN host settings), doesn't work either. Everything is routed via the VPN, even if it doesn't match the routing rule, and it's not the default route in the VPN settings.

https://www.draytek.co.uk/support/guides/kb-vpnservice-expressvpn

Looking like something is broken in VPN/Routing since 3.9.5, as rolling back to 3.9.4.1 and it instantly started working as intended.. Going to anything newer, and VPN clients routing is broken, going back it springs back into life again. That's 2 weeks of my life I'm never gonna get back. Good job there is a pandemic on, and there is F-all else to do than tinker with routers.

Fixed in 3.9.6.1 and confirmed by Draytek that it was a bug. It's not mentioned in the release notes, but they confirmed it was fixed.

It's a shame the release notes don't really paint a full picture. Anything that is reported by a customer should make it to the release notes, otherwise there is no point.