If I were a major, anticompetitive ISP, the minute I found out about this tool, I would figure out how to fingerprint it, and then artificially inflate results by giving priority and bonus bandwidth to its tests.

What is this app doing to prevent that? I don't see any mention of any awareness that ISPs have historically gamed speed tests and what countermeasures FCC has taken.

Idea: would it be possible to built an app that measured the speed of connections for other apps by using the platforms' VPN APIs to create a dummy VPN service that just measured bandwidth/latency?

Fingerprinting something like this would be trivial, they've probably already done it. Using the ja3 library [1] you can make pretty good deterministic TLS connection fingerprints, and that works fine for traffic that you can't decrypt. IDS/IPS software has used similar methods to identify and block encrypted traffic for some time now.

[1] https://github.com/salesforce/ja3