You are right that macOS might provide a trigger for apps to know about VPN changes. I really don't know enough to know if macOS actually can do that. I'm not an API programmer. So you can either wait for someone who knows APIs to investigate that for you, or you can try another approach that I've helped someone else with over the last week.
I was helping someone about detecting (and changing) a camera's availability. Detecting a VPN could probably be done the same way. So I suggest you read the following post and let me know if that helps, or if you want me to help you more directly.