In general it has appeared that Android routes all traffic into the VPN, even traffic of system applications and components, but a manufacturer could decide to exclude certain traffic types, reducing the security that can be achieved by a VPN based firewall.