What is a 'VPN kill switch' on mobile and what specific attack scenario does it prevent that a regular VPN without kill switch does not?

• A.A kill switch is required for split-tunneling VPNs; without it, traffic designated for the non-VPN path might accidentally route through the VPN tunnel during tunnel failures
• B.A VPN kill switch prevents mobile devices from switching between VPN servers; this stops IMSI catchers from triggering VPN server hops that expose the device's real IP
• C.A kill switch terminates all running apps when the VPN disconnects, preventing app credentials from being exposed in the brief unencrypted window
• D.A VPN kill switch blocks all traffic when the VPN tunnel drops or is being re-established; without it, there is a window during VPN reconnection where traffic flows unencrypted (a 'VPN leak' or 'reconnection leak') - an attacker who deliberately disrupts the VPN connection can observe the device's traffic or real IP address during the reconnection window