As opposed to leaking your VPN's IP address, which is about as meaningful.
> You're also trusting any other networks that you connect to when you open up your laptop in a coffee shop or hotel room not to have a sniffer sitting on them.
True. Which is why a personal VPN to your home network is useful.
> You're trusting tons of faceless organizations across the entire chain of you to the website you visit to be safe with your data.
The connection from the VPN provider still goes through a similar chain.
It's true that the chain will be substantially different if you, say, connect to a service in the US from the UK via an Australian VPN service. On the other hand, the chain will be way longer if you use that Australian VPN to look up your local pizza place's menu.
Unless you're very lucky with providers, your local IP address is good enough for me to get at least your zip code, and if you're particularly unlucky with your provider/network setup there are theoretical attacks that can be used to get even closer to your physical location[0].
By comparison, the closest VPN address to my physical location is in a different state. That really matters if you care about privacy -- without a VPN you are broadcasting your current town to literally every single site you visit.
> The connection from the VPN provider still goes through a similar chain.
But when it goes through that chain, the request is sent from the VPN provider, not from your own IP address, which is significantly more unique and easier to track, even if you've taken steps to block browser fingerprinting. Request aggregation is by no means a perfect defense against tracking, but it is significantly better than not aggregating requests.
> Which is why a personal VPN to your home network is useful.
Granted. If you've set up a personal VPN to your home network and you're maintaining your own server to make that work, that'll protect you when you browse at a coffee shop. It's also a lot more work for the average user (it's certainly not a viable substitute for what Firefox is doing here), and if done incorrectly a home VPN can make your network vulnerable to attacks because it forces you to open ports.
So my suggestion if you're going down that route would be to buy a 3rd-party server on something like Linode and set up your VPN there. That way a poorly configured server won't make your home network vulnerable. That will also protect you from at least the geolocation attacks I mentioned above. You won't have the advantage of sharing an IP with other people, but I can see that being an acceptable tradeoff for people who want more control.
At that point though, you've basically just rolled your own private VPN provider. You can debate whether or not it's better to roll your own provider or use an existing provider, but in either case, you're still using a VPN. Because VPNs are strict upgrade to network security for most people.
[0]: https://arstechnica.com/tech-policy/2011/04/getting-warmer-a...
I agree overall about the benefits of getting more reliable auditing for VPNs, I think that's important and I'd like to see Mozilla release more details.
But I strongly disagree with the "shifting trust" explanation that people use when they talk about VPNs. People bring up this point all the time, that if you can't guarantee trustworthiness, there's no benefit. And it's ridiculous -- even a moderately trustworthy VPN is a benefit over not using a VPN.
VPNs consolidate trust. When you don't use a VPN, you aren't just showing your traffic to your ISP. You're also leaking your IP address to any website you visit. You're also trusting any other networks that you connect to when you open up your laptop in a coffee shop or hotel room not to have a sniffer sitting on them. You're trusting tons of faceless organizations across the entire chain of you to the website you visit to be safe with your data.
The main benefit of a VPN is not just that it hides your data from your ISP (although that alone is a really good benefit because we already know that most US ISPs are untrustworthy). The main benefit is that you only need to trust one company with your IP address instead of every single individual website that you visit, and that you only need to trust one provider not to sniff your traffic, instead of every single ISP that you connect to.
If your VPN is moderately trustworthy, to the same level that you would trust an ISP like Verizon, then it is a strict upgrade in security to use that VPN for all of your traffic, because you're eliminating some of the lowest-hanging network vulnerabilities while you travel and putting a barrier between yourself and the websites you visit so that it's at least slightly harder for them to track you or tie you to a physical location.