These aren't theoretical. Freely available tools make them trivial to execute.
Auto-connect triggers the moment your device joins an open or untrusted network β before any app has a chance to make an unencrypted request. You never have to remember to turn the VPN on.