It is considered a PaaS service because you have no need to manage the VMs that are deployed - they are in the background and managed by Databricks. PaaS vs IaaS is not just about how the service is physically deployed but about what parts of it you need to manage.
A VNet again not just associated with VMs. Anything that needs an assigned IP Address would normally be connected to a VNet - otherwise how would the traffic get to and from it?
For the Control Plane - this is just where they are hosted. You have access to the web application to manage your clusters, attach your Notebooks and schedule your jobs to process YOUR data that resides in YOUR account.