A similar issue was discussed in the Fedora forum. When the connection of a WireGuard client, to which all traffic is routed, goes down, it naturally gets the kill switch function, unless it is manually disabled.
NetworkManager preserves the WireGuard interface and its default route even when the server is down or unreachable which effectively provides a routing based kill switch OOTB.
For other VPN protocols that connect to a VPN server and authenticate, this is invalid and extra settings are required for the kill switch function.