From my understanding, a VPN kill switch modifies routing to make sure that all traffic must be sent through the VPN's tunnel interface, and otherwise internet access is restricted. On desktop applications it seems quite obvious how this could be implemented since apps offering these sorts of services would have administrator privileges anyway and can modify routing tables.
However, when it gets to mobile platforms, applications don't have these permissions so I'm confused as to how a kill switch like this can even operate. Many providers of VPN services (Surfshark being an example) support a kill switch in their apps on all platforms, including iOS and Android.
On Android, blocking traffic outside of a VPN connection wasn't even possible up until Android 8.0+ (on 7.0+ an always-on option can be set too) yet these apps support Android 5.0+. In addition, this setting has to be manually turned on by the user which doesn't happen in the apps.
On iOS, it seems like a kill switch isn't even possible on any version: https://developer.apple.com/forums/thread/113636. I do know that there is an always-on setting that can be configured since iOS 6 however (like Android), and even though this isn't by any means a kill switch is this what these apps could be enabling?
I'm just curious as to how apps like this can claim to protect data leaks like such with a kill switch if they don't have the necessary permissions to modify routing options? In this case, will they be using OS features such as an "always-on" connection and passing it off as a kill switch because you're in theory meant to always be connected? Or is there actually a way that they might be able to disable internet across the whole of the device if a change of IP is detected?
I hope this is the right place to post a question like this, and if anyone has any details on how this might work it would be greatly appreciated.