Always make sure that QBT uses your VPN's network interface. I got some DMCA emails despite split-tunneling a VPN recently, and I realized it was bound to all interfaces by default - that's no good.
How is that better? If you configure your firewall rules incorrectly, this protects you against that. This ensures you have no connection if your VPN isn't on/isn't working.
Thats what the firewall rules do too, don't allow internet connection if there's no vpn connection.
Firewall is a system-wide solution that always works, while qbt config relies heavily on the application implementing interface binding properly. Which it doesn't fully btw.