I'm supporting android proxy Drony that has ability to also use VPN mode so it can intercept all flow and redirect to proxy that is set in settings.
Recently was added also support for local SOCKS proxies. This includes also Orbot. For now only TCP flow goes to Orbot SOCKS proxy on port 9050. Reading about Tor I find out that problem is also DNS UDP called as DNS leakage. So there will be additional change, when Orbot is involved, to redirect UDP DNS requests, or maybe just all UDP to Orbot?
Question is, there should be also any other additional action performed that will add protection for user on Android device? Not meaning changing http requests (removing headers or similar actions), more changes on TCP, UDP packets headers before they hit Orbot proxies.