The latest free versions of proton do not have this behavior, you get a guest account now that honors the kill switch.
That being said I do like your proposal, but it depends on the vpn solution to let anything through. If the kill switch is on, but the vpn solution lets anything through, you are toast and nothing in my opinion GOS is able to do about it. Not connecting to internet at all would work, but then again, your vpn wants to connect to see the subscription status.
I have used Rethink extensively in the past and loved the software for its versatility and options. But I stopped using it because for me it was the development cycle that was not reliable enough. With a better release cycle, more testers, users and developers I would switch back again. Rethink would have stopped the connection if the vpn certificate and connected subscription had ended in your particular case. But I am not so sure about the kill switch being obeyed in normal use, maybe I am too overly worried.