I think it’s better to install a VPN on a router, one paid in XMR if possible. I think device level is easily compromised with effort and intent.