Because IP address can still leak. Each time you connect to the internet, your ip is blasted all over the place. You can not be sure that your vpn app handles reconnects etc safely. Safest is to use a mobile router with always on VPN that blocks internet when VPN doesn't connect. Might be overkill but if you are an activist (I'm not) you would need to be super cautious.