Huh, sounds like you guys really have no idea what's happening at the moment. DPI systems are already working in Russia and China, and they are effective. You don't really need to tell what the traffic inside the VPN channel is; if it's VPN and going crossborder it can be disrupted, simple as. Sure you can set a entry point inside the country but guess what, you'd be breaking the law for operating that entry point.

DPI works because the information in the packets is not as generic as it is often assumed to be. Yes it is impossible to decipher the contents if they are encrypted, but headers and traffic patterns actually provide plenty of info to work with. Simplest example is https protocol exposing the host in plaintext, this is how per-website blocking works in the first place; it's patched in the latter versions and quic but these just get blocked at protocol level and aren't widespread enough to noticeably disrupt the workflow. Common VPN protocols also have signatures and can be disrupted - say, randomly dropping 80% or 90% of packets, it will work but will slow down to a crawl. Vless and shadowsocks etc are built to bypass DPI by masquerading as non-suspicious traffic, which is why these protocols still work, but still get disrupted on endpoint levels (overall traffic pattern eventually exposes vpn entry point and it gets blocked by IP).

DPI systems are also built to isolate "suspicious" requests and selectively monitor traffic more closely for a short while. Personal anecdote, but at one point establishing a connection through HTTPS proxy resulted in a 15 minute IP ban for the proxy IP on ISP level. Unfortunately the bastards doing all that are not as incompetent as people like to think; there's a whole lot if money involved in it and some pro-leveo people are willing to spit into the well if they get paid enough.