mmmm AOSP's Lockdown Mode doesn't work the way you think it does in case of RethinkDNS. If you click 'stop' in RethinkDNS app, it'll route everything bypassing whatever proxy you're using. The official Wireguard app, on the other hand, handles it differently. Once the in-app VPN toggle is off, no traffic is allowed to bypass a VPN.