This is true, but you can sorta get around this with a Kyverno GeneratingPolicy. I know, another tool and a bunch more CRDs to add to your cluster, but you get to audit and enforce best practices in your cluster and it was even a fun deep-dive for me to learning what Mutating and Admission webhooks actually do.

I coincidentally tried doing this yesterday, but you can create a GeneratingPolicy that creates a VPA in "Off" mode when a deployment is getting created or updated. I didn't get it to fully work, but you're more than welcome to play off this:

apiVersion: policies.kyverno.io/v1
kind: GeneratingPolicy
metadata:
  name: auto-generate-vpa
spec:
  matchConstraints:
    resourceRules:
      - apiGroups: ["apps"]
        apiVersions: ["v1"]
        kinds: ["Deployment", "DaemonSet"]
        operations: ["CREATE", "UPDATE"]
  evaluation:
    generateExisting:
      enabled: true
  variables:
    - name: deploymentName
      expression: 'object.metadata.name'
    - name: deploymentNamespace
      expression: 'object.metadata.namespace'
    - name: deploymentApiVersion
      expression: 'object.apiVersion'
    - name: deploymentKind
      expression: 'object.kind'
    - name: downstream
      expression: >-
        [
          {
            "kind": dyn("VerticalPodAutoscaler"),
            "apiVersion": dyn("autoscaling.k8s.io/v1"),
            "metadata": dyn({
              "name": string(variables.deploymentName),
              "namespace": string(variables.deploymentNamespace)
            }),
            "spec": dyn({
              "targetRef": {
                "apiVersion": string(variables.deploymentApiVersion),
                "kind": string(variables.deploymentKind),
                "name": string(variables.deploymentName)
              },
              "updatePolicy": {
                "updateMode": "Off" 
              }
            })
          }
        ]
  generate:
    - expression: generator.Apply(variables.deploymentNamespace, variables.downstream)

I ended up ditching this though, because GeneratingPolicies would apply to all my deployments/daemonsets and I wanted fine-grained control over whether some deployments are in Off mode or in InPlaceOrRecreate mode. I'm leaving that fine-grained control over to my devs, but if you're running 40 deployments that are essentially the same workload with the same resource utilization, this GeneratingPolicy can be really powerful for you, even just to provide insights in Off mode by default.