iOS: Security: VPN On-demand vs. Always-on


Freshly Joined Member
Hi all,
what is your opinion regarding protecting an iphone against malware-attacks while logged in but not causing internet traffic betweeen both alternatives:
a) VPN On-demand
b) Always-on.
Are there any security risks if you manually select a specific connection by „VPN On-demand“ immediately after logging your phone in and leave it (for hours...) – will it automatically be logged out and leave the data connection of the phone exposed to potential attackers ??