Yes, this is largely the browser's problem. Because all available uplinks are available. Tor browser doesn't leak, because WebRTC is blocked. But other browsers with WebRTC enabled will leak with a standard Tor setup.

However, using Whonix for Tor, even if you install a random browser with WebRTC enabled, there is no WebRTC leak. Because the workstation VM has no Internet access except through Tor. The gateway VM is not a router. There is no forwarding, and it's firewalled. It just exposes Tor ports to a private internal network, for the workstation VM.

And one can do the same for VPNs, using pfSense VMs as VPN gateways. Apps in workspace VMs have no Internet access except through the VPN client running in the gateway VM.