As you probably know, when you hold the power button one of the options is lockdown. This feature has a few flaws, first of all, if you have the VPN widget enabled you can swipe down and turn off the VPN without unlocking the phone. Additionally, you can also stop active apps without unlocking the phone allowing you to potentially stop say a audio recording app or a VPN client allowing unprotected data to continue over the current connection. This can be mitigated by enabling the Android block connections without VPN feature, but this still allows someone with physical access to the device to disable it's connection to the internet without logging in. This is fairly minor overall, but I think it should changed.