What they really mean is we need to prioritize #1863 as well as investigate some hardware solutions like those provided by GL.inet.
The reality is there are many reasons for leaks see: Your VPN Kill Switch Won't Stop All Leaks they’re all pretty crap besides offloading to a routing device they’re all pretty bad. Ultimately if you want to depend on it, that’s your option.
Other than this decision to follow Apple’s recommended practices they’re a lot better than many of the competitors out there who don’t even provide any source code to their applications.
The other thing we’re also aware of, is tightening the criteria to the point where we only have one VPN provider really means we will have to remove the VPN section. As it is there are dangerously few decent VPN providers out there. We’d like to add more to the page.