Customer side Resposibility- Network Traffic Protection

How can the customer be responsible for Network Traffic Protection, as the customer access instances through VPC. Isn’t VPC similar to VPN, if not what is the difference between them?