“In our testing, the VPN always continued to report as connected, and the kill switch was never engaged to drop our VPN connection.”
A rogue DHCP server on the coffee shop Wi-Fi uses option 121 to push routes more specific than the VPN’s, and your traffic walks out the physical interface in the clear. The option has been in the DHCP standard since 2002. That makes the hole 22 years old. The VPN app still shows connected the whole time. VPN companies sell exactly this scenario, the hostile hotspot, as the reason to subscribe.