Using function is much slower than running query
The extra times goes to the overhead of plpgsql, which is not small.
With RETURN QUERY, it first reads all of the tuples into a tuple store, and then reads them back out again. In this case, I think that that accounts for most of the additional time.  Note that this extra overhead will be proportional to how rows are returned (not how many are inspected but then filtered out).