Use docker. There are docker images which have vpns and torrent clients inside. The torrent client only gets connected to the internet when a vpn connection is established.

I am not an AirVPN user, but you might want to look for whether AirVPN supports filtering traffic based on port numbers, and then you can set a fixed port in your torrent client which AirVPN will always route through the VPN (and allow other traffic such as DNS and HTTPS to go around it).

Some VPNs support app-based split tunneling (such as Mullvad), but it seems from a quick search that AirVPN doesn't. But if it supports port based filters, you can accomplish the same thing.

I think pihole shouldnt slow down qbittorrent at all, but isnt pihole host using another DNS? Hopefully someone more experienced can jump in.

Anyway, use docker containers qbittorrent and gluetun. Setup gluetun for airvpn and bind qbit network to gluetun. Thats real killswitch. Alternatively you can set vpn in qbit settings, but double check is that 100% safe. Not all kill switch work like they should, and there is a risk of leaking home IP if VPN server craps out or maybe even on restart. There is also kill switch feature in airvpn client (eddie), but Im also not sure is it good as gluetun. Im using docker gluetun and qbit, just because lot of people recommend it

First you need to get some small sails and rigging. Argh!

To be fair your brother would probably still have gotten viruses even with a pihole lol. It won't prevent you from downloading sketchy shit.

I just bought a Pi and set this up a couple of weeks ago. I turned my Pi into a NAS using OMV 6 (Open Media Vault - free), installing docker compose and qbittorrent in OMV, also installed gluetun docker in OMV, and then added my, opened a port in AirVpn, and added the port to gluetun and set the network_mode argument in qbittorrent to my gluetun container. Now qbittorrent only connects to my vpn. OMV has extensive documentation for setting it and docker compose up, and the OMV community forum is extremely active.

Check if airvpn client has a Killswitch option.

Are you using docker? If so, you may use gluetun or run the vpn client inside the qbittirent container

Also, some vpn provide adblocking. So, another way would be... skip pihole and just use raspAP to create a WLAN where all devices connect. You may even turn off your router wifi and rename the newly created WLAN so that your brother doesn't even know ;)

I haven't tried it really, but maybe there are tutorials.