If a user sets up a stock Android device to use a VPN and uses the "Always-on" setting, can they be sure[1] that no traffic will leak outside of the VPN?
[1] Assuming no malware is installed by the user and the OS is not trying to deliberately circumvent the VPN secretly.