Here's the thing about FFXIVAPP and VPN's. Square can't verify if you're using one or not. Both of these programs are passive, they don't modify any core files so even if they are in use and against the ToS, Square can't verify them and can't ban people using them.
FFXIVAPP just reads the data logs and parses them over for compiling and formatting. This is all done locally and since core files aren't changed or affected, the version check never sees it and never reports it to Square. All it's doing is parsing information people can see already so you the user doesn't have to math it yourself. FFXIVAPP isn't injecting any packets or sniffing any data beyond logs (and this is done locally making it impossible for Square to verify you're using it and since it's already available for view by anyone, it basically makes parsing just a fast way to add numbers together).
All a VPN/Proxy/Tunnel does it change the route path you normally take (which is determined by your ISP and not by Square) for the client/host handshake. The reason why these work so well is because some backbones have massive problems (Also which isn't controlled, managed, or monitored by Square). By changing your data route path, you have a better chance at being able to avoid these hops and gain a stable connection. On a side note to this; Your ISP can do basically the same thing as Tunnel software. The ISP can change your data route path on demand (though you better have a really good reason and the data to back it up. ISP's are soooooooo lazy if you ask for that). Square can't control the path of data flow outside their network. As this is dictated by the ISP/backbones and Square works with all network infrastructure, this wouldn't be against ToS (ever log in when you're at work? Odds are you're behind a firewall/proxy/VPN)
The same also applies to the ENBInjector (allows you to add custom graphic settings to the game like enhanced HDR, lighting, and bloom effects). I believe that Square specifically commented on the use of this application and indicated that this program is fine (you actually have to drop this program into the x86 program files for FFXIV itself which, if anything would be more against ToS than FFXIVAPP and VPN's). Here is the link: http://forum.square-enix.com/ffxiv/threads/86742-ENB-Injector-for-FFXIV-%28wip%29/page6
If I had to make an educated guess, if the ENB injector (which you have to drop into the folders that don't want you to modify in any way) is okay, it's not a big stretch to assume that parsing shouldn't technically be against ToS (VPN's would never be against ToS. Networking simply doesn't work that way and Square wouldn't have control of the path even if they wanted to). The only reason I could see for VPN's to be a problem would be if Square has bans set up to ban I{'s and not accounts (which isn't the case).
I'm not defending parsing or anything (I feel it allows players to degrade others and to shame them into leaving the party/game which hurts revenue as a whole or enables their inferiority complex to reach astronomical heights) but there is no real way to track if you're using one and no core files are being altered (Which IS against ToS).