a VPN tunnel was shut down and recreated with a different set of
routers when an attack was detected on the VPN tunnel.
A VPN is started by connecting to a VPN server and obtaining information about the tunnel. This information can change the next time the VPN setup software contacts the server. Some VPN software might specify backup servers to contact if the first are not available. If someone on the server end changed the DNS to point to a different server during an attack, the VPN setup software could still setup a tunnel using a different VPN server on that VPN.
How can the VPN connection actively change the network route? Isn't an
Internet connection established automatically through routing tables
and is therefore outside of the realm of things the VPN can actively
It depends on the type of VPN. A VPN that works by installing virtual network adapters on the client side will actually require changes in route tables to function. These changes may be "automatic" in that any interface that is directly connected gives you routes to the subnet behind it - and with a VPN, you'll be "connected" to a virtual subnet. Or, some VPN setup software adds routes - usually done to make all outgoing Internet traffic go through the VPN.
Things that are really "port forwarding" and not VPNs per se (like SSH tunnels) of course don't do anything with the routing table.