Librem 14 actually removes power completely from the Wi-Fi card when killswitch is in off position and this is why Wi-Fi killswitch needs to be on when Qubes OS is booting as boot phase is when PCIe devices are detected by Qubes OS. If you switch the killswitch to off position after boot you need to reboot to enable Wi-Fi again.
Wi-Fi LED is on when there is traffic not when its “on” and receiving power.
The automatic killswitch script only detects if the Wi-Fi card is present during boot and attaches it to sys-net if it is. If Wi-Fi card is not present, script detaches it from sys-net, this occurs only when Wi-Fi card is already assigned to sys-net.
You may want to add more lines like Before=qubes-vm@sys-net.service for other VM’s that may start during boot and require sys-net (such as sys-firewall).