Here is the documentation page for Advanced Privacy. You will notice Orbot specifically mentioned. For instance
Advanced Privacy is using an implementation of the Tor project. We extracted the core functionality from the Orbot application, and added a user interface on the top of it.
I just checked in my system, APs vpn options are greyed out by default as it seems.
Are you 100% definitely sure they weren’t greyed out before you tinkered with orbot?
AP is integrated as a system app, therefore I presume these settings are set as needed and not to be changed by the user… It’s always on anyways as long as it is activated.
Edit for clarity. When AP was introduced we found the phone had to be restated to force changes.
My proposal would be to toggle off all AP, Clear AP Storage (that is all storage, not just cache) and restart phone.
Now check VPN none, dns auto.
Check the phone has no defects.
Add another restart.
You could even reintroduce AP progressively, one toggle at a time, with restarts, just to check for certain where the error reoccurs.
As you first surmised AP should have repaired with upgrade unless some user installed app or Settings were preserved.
One more thing to consider is the method used to Upgrade a13 to a15. While dirty upgrade is often successful the official advice is to Format data. Also worth observing that early version 3.0.x did contain some bugs, maybe another reason to Format data at upgrade.