If “automatically connect vpn on application launch” is enabled, it seems to override the setting for untrusted wifi and connect anyway, even if the device is connected to a “trusted” wifi network.
I should note that, as far as I can tell, the iOS app handles this feature just fine. I assume this is because there is no “auto connect on launch” feature in that app. For the macOS application, I would just suggest removing the auto connect on launch feature all together, and instead have the “untrusted wifi” setting determine whether the application should connect to vpn or not on launch. Having both settings seems to be conflicting in their function and a bit redundant too.