'VPN means secure'

"We use a VPN" gets offered as an answer to questions it does not address.

It protects a path to a particular endpoint. It says nothing about whether the device at your end is compromised, whether the destination deserves trust, or what happens to the data once it arrives. For consumers, the significant change is that almost everything is already encrypted, so the tunnel mostly moves who can see your browsing from your internet provider to your VPN provider. That may be a trade you want. It is a trade, not an upgrade.