If this is a WireGuard VPN, what you're calling "their gateway" is probably a virtual IP address associated with the virtual WireGuard network interface running on your machine (with the interface probably named
wg0 or similar, and the IP address probably belonging to one of the private-use blocks like
Adding routes for
128/1 to this interface ensures that those routes have a lower priority than any other explicit routes you already have set up for your machine (like you probably have a
192.168.1.0/24 route for your LAN) -- but have a higher priority than your default route. So the
128/1 routes don't interfere with your custom routes, but they do override your default route.
So any traffic not matching any other routes you have set up will be routed through this virtual WireGuard network interface, where it will be encrypted and queued to be sent to your VPN provider. But in order to send this encrypted traffic from the virtual WireGuard interface to your VPN provider, your machine needs to know the real route to the VPN provider's real servers.
That's why your VPN provider has added an explicit route for their servers -- the encrypted WireGuard traffic needs to be routed through your local Internet gateway to their servers. Without an explicit route with a higher priority, the encrypted traffic bound for their servers would match either the
0/1 or the
128/1 route, and loop back into the virtual WireGuard interface again.