@divB is essentially right in his explanation. The feature for including the internal traffic in a vrf was present from the outset (/ip vrf). This adds the ability to enroll the outside (encrypted) traffic as well.
For an example of a situation where this makes sense, you only have to look at how wg-quick does it by default. (Yes, we’ve finally achieved feature parity in a common case…)
When you want to tunnel all your traffic through a vpn provider, e.g. ProtonVPN, you can just:
- Add a vrf “outside”
- If you have internet with dhcp, add etherX to this vrf; if you need pppoe, add the client interface.
- Configure wireguard, with vrf “outside”
- Add default route in main through the wg interface, configure masquerading
This way all your traffic will be routed through wireguard, including your dns, fetch commands, MT software updates, everything.