Fucking Lennart.
I had to dig into systemd-resolved once I found it was leaking the real IP despite being connected to the VPN. 🤦🏼‍♂️
https://github.com/systemd/systemd/issues/6076#issuecomment-387332572 (I'm arno01 there)

Figured the best is to use a router such as GL.iNet Beryl AX (GL-MT3000) with the VPN+kill switch and then it doesn't matter how systemd or any other part of the OS is broken.