“Unfortunately apps are not required to respect the routing table and can send traffic outside the tunnel if they try to. Some examples of apps that do this are Apple’s own apps and services since macOS 14.6, up until a recent 15.1 beta.”
After a macOS system update the firewall can ignore its own rules until the next reboot. The routing table still points traffic into the VPN, but nothing forces apps to follow it. Mullvad has reported it to Apple and the workaround is a restart. Apple sells privacy, and its own apps were the ones walking around the tunnel.