Weak DNS handling, reconnect leaks, and bad enforcement don't disappear just because you stacked another VPN on top.