pfSense

That's the nature of the default "automatic" mode -- when left to select it will select whatever gateway is the first available one in the list.

It isn't intelligent enough to pick between physical and virtual interfaces because end users may set them up however they feel is best and what works for some may not work for others. Some people may want to use a VPN as default, it has no way to know since it's picking from the entire set.

If you wish to set a preference of order to only allow certain gateways to be default, then make a custom failover group with the exact order to use and then set that as default.