It's easy to disable a VPN remotely though, especially on handheld devices.
All you need to is to point the user to a post or a website that is bloated with JS and contains high rez images and/or video.
The device then has to either begin paging memory like crazy - or more likely - begins to kill background processes that it thinks are not used by the foreground apps (e.g. your VPN).
For newer smartphones this is less of an issue, since their RAM can handle it. For > 5 year old smartphones though? They might struggle.
If you run a VPN app, you can use AFWall to force all traffic through the VPN. So if the VPN app isn't running for some reason, the apps set to only go through the VPN service will have no internet access.