A: Installed apps can request to be bound to a specific network, bypassing the VPN. The VPN app can of course block this (but not all VPN apps do so). Rethink blocks this.
B: The OS can fwmark any socket to have it bypass the VPN (for connectivity checks, for instance). AOSP only affords this for System apps.
C: The end-user can prevent “A” from happening by putting the VPN app in “Lockdown” mode (ie, turn ON Block connections without VPN on Android 10+). The end-user or the VPN app has no say on “B”.