WireGuard
A few thousand lines of code instead of a few hundred thousand. Small codebases are easier to audit and leave less room for mistakes, and the lean design means less overhead per packet, which usually shows up as higher throughput.
OpenVPN
Older, larger, slower — and the most compatible option there is. Because it can run over TCP on port 443 it looks like ordinary web traffic, which is what you want on a network that blocks anything unfamiliar.
IKEv2/IPsec
Built into iOS, macOS, Windows and Android at the operating-system level. Its standout property is MOBIKE, which lets a tunnel survive a change of network: walk out of a café and onto cellular and the connection follows you instead of dropping.
Why iOS apps often start with IKEv2
Running WireGuard inside an iOS app requires Apple's Network Extension entitlement. Until Apple grants it, IKEv2/IPsec is the protocol an iOS app can ship with — which is exactly why the DESEO iOS app uses IKEv2/IPsec at launch and lists WireGuard as coming soon.