Just because something is called with the same name, doesn't mean it's the same thing. Especially if the naming is done on a product by a company that wants to sell the product, and especially if the name is not a protected trademark.
Express VPN, NordVPN and Surfshark belong to another category of software than the VPNs used by companies.
Some differences are:
1- One is used by consumers, the other is used by businesses.
2- One protects communications to a client-controlled Local area network. The other protects communications with third party services.
3- One provides encryption, the other provides anonymization.
First, a hammer is a build (compile time) tool, while VPN is a runtime tech. Closer to a nail if you will.
Additionally, millions of products use hammers, while there's two product categories that use VPNs.
The product distribution of VPN products is bimodal, there's no inbetweens it's either a privacy oriented consumer VPN, or it's a security oriented corporate product.
Regarding the specific technology, there is no technical definition of what a VPN is, it's not an industry term, it's a marketing term. Similar to "Web", it's not HTTP, it's not TCP. This is in stark contrast to Internet (as in Internet Protocol).
Related technologies are IPSec, IKev2, WireGuard, but VPN is one of those trademarkless industry buzzword terms that companies are can latch onto for free and participate of a commodity market.
On an unrelated note, this is not unlike the term AI, which can somehow apply to fake images and conversational software. And coincidentally, modern AI is also bimodal, it's either text or syntethic images, the common ancestor might have been that the textual product originally was also synthetic generated text, but with agents and text as thought (in a Sappir-Whorf fashion) have since greatly diverged.
