You may be interested in reading 'Mission Impossible: Hardening Android for Security and Privacy' and it's update 'Mission Improbable: Hardening Android for Security And Privacy'.
To directly answer the question, if iptables and root access is available, then "Tor Everything" will provide a more complete means of enforcing Tor usage on the device, since it is applied from the linux kernel rather than the userspace portion of the operating system. It's acknowledged that the VPN may leak, it's there as a best effort option for people who do not have root access on their devices.
There is still a potential for leaks, since Orbot starts up along with the other apps on the system, if one of them beats it to running iptables then they will connect outside of Tor. To this end, there are further steps you can take.
OrWall performs some of the same actions that Orbot does (note: it will conflict with Orbot trying to "Tor Everything", use one or the other, not both!), it provides a more granular set of options, allowing you to set a network policy per-app, so you can deny network connectivity entirely, enforce transproxy, allow it localhost access or allow it to connect directly without Tor. It also places an "init" script into the android filesystem, which blocks outbound traffic much earlier in the boot process which stops leaks, since before any apps get to start outbound traffic is already disabled, and will only be enabled when OrWall starts later and sets up the users chosen policies.
Much of these problems also come from how fragmented the android ecosystem is, there is little to no uniformity in deployed operating system versions, kernel configuration and features and functionality provided in some of the included binary blobs. The android ecosystem is currently not really suitable for high security use outside of very specific cases with known hardware and lots of work put into it (see the Mission Improbable post and the work of the Copperhead OS team).
