Require VPN doesn't autoconnect to VPN
If you have a local area network and you import an existing OpenVPN configuration file into Network Manager, it at times does not automatically connect to the VPN on boot. If there is an issue with the connection to the VPN and it breaks, Network Manager reconnects using the actual IP address, exposing it.
It shouldn't expose it, but if there is an issue with the VPN and it is set to be required then it should just disable the network connection.
This used to work back on Ubuntu 16.04 with Gnome desktop environment installed through their repo. It stopped on Ubuntu 18.04 and Debian 9.
NetworkManager Version: 1.2.X