Why do I need tuntap for HideMyAss?
You don't need any kernel extensions. OS X has VPN configurability built in as well as all the UNIX tuneless and networking code and commands you could possibly need for securing the network. (It's BSD under the hood, after all).

Why that one package needs a .kext could be innocent and performance tuning or to prevent needing a password to change things later or it could be nefarious for any number of reasons.