Implementations differ: firewall-level switches block all non-tunnel traffic at the OS, while app-level switches only close specific programs. The difference shows during connection drops, network changes, and sleep-wake transitions, which are the moments leaks actually happen.
A switch protects the IP association, not the content of what resumes after reconnect. Setup guides linked here cover verifying the behavior rather than trusting the checkbox.