Thanks. We are indeed using onDemand rules to get around this. It still has side effects (see below), and I still think this is something that should ultimately be solved on the iOS side.
Side effect: Users are unable to turn off the VPN from Control Center's stock VPN toggle or the system Settings app, as the onDemand rule causes the VPN to turn itself back on as soon as a network request is made. (We do have our own Control Center Widget to partially help, though.) We've gotten some user feedback - especially when trying to access captive portal screens on airplanes, for example - that they're unable to turn off the VPN from the system settings and end up fully uninstalling the network extension, and that's just a bad user journey.