I have the feeling it happened before after a system update, so I am gonna write about it now.
Not sure if this can be fully relied upon, but I often disconnect (Proton) VPN connection, to let the profile not have an internet connection.
I do the same occasionally after rebooting. When I tether the device, I often don't need profiles to have internet anyway.
This behavior made me aware that I still had an internet connection, even with the "Always On" and "Block all connection without VPN". (I check this for every profile like monthly, because I have the suspicion that the setting one time reset in the past)
For example after the system update reboot today, I logged into my secondary profile, clicked off the VPN connection in the pulldown menu as it starts automatically. Then after 30s I get notification for a RSS reader. Afterwards I checked browsing etc. too to know that I have mobile data active and working without VPN (not just offline pages, I clicked more).
Ironically, the other profiles are working with their killswitches, same app. I was opening the VPN app to make sure its not a display bug in the pulldown menu in the affected profile.
I have the logs of the vpn app but not sure if they would help, or what other types of logs would be helpful to get in such a situation. Would it be better to wait for "optimizing apps + restart apps" to finish completely first? I went back to main profile and clicked it, back to secondary, still had internet without vpn.
A profile close/relogin solved it, maybe just connecting to VPN would have to.
Would the recommendation be to just always leave VPN enabled and not rely on the killswitch but only airplane mode then?