You make good points about VPN alone.
My primary goal with using one for browsing etc is less about security than simple user privacy enhancement - reducing how much targeting data gets explicitly and blatantly collected by innumerable third parties to be shared and sold.
That along with a browser like duck duck go. Just a few improvements.
If I’m putting Bitcoin in cold storage, then a Tor connection to protect a “family savings account” is warranted 🤙