> The only way to configure this however is using the Apple Configurator tool and create a custom profile. 'Activate on demand' is just a checkbox in WireGuard

> The only way to configure this however is using the Apple Configurator tool and create a custom profile. 'Activate on demand' is just a checkbox in WireGuard app settings on iOS, so apparently it's only the built-in VPN types that need Apple Configurator. Since IPSEC/IKEv2 are overengineered and L2TP is outdated, you're better off using wg anyway.