Even if there is N% possibly that a three-letter agency can find an identity correlated to a Tor client in M time, VPNs are much more likely to either be malicious or compromised. And worse, most if not all VPNs don't onion or scatter-route traffic; every single network request goes directly to the VPN provider whom I must explicitly trust.
Granted, this isn't a problem if you run your own WireGuard/IPSec/OVPN instance on your own hardware, but for most people in unfree countries this simply isn't possible.
What's worse is that now not only do governments possibly collect your data, but a random third-party entity as well. Because of this, I only use VPNs when the alternative is nothing at all (like airport wifi that blocks Tor connections).
You probably don't want to connect with a home cable connection. Break into other WiFi or use public WiFi hotspots. Preferably never the same one twice.
Compromised machines can be a mixed bag and require some actual work, but people definitely use them as additional routes in their chain of proxies. You could also use cryptocurrency to buy VPSes to use as VPNs potentially, which offer usefully different privacy characteristics than VPNs as a service.
Even if you get everything else right, the worst enemy will always be you. You need to regularly cycle identities, never reusing them or linking them back to previous identities. If what you're trying to accomplish does not make this possible you most likely are not going to be able to stay anonymous forever.
This is basically the same advice you'd give to someone trying to commit crimes. Well, if you consider any potential adversary to be a threat, it's pretty much the same approach. I think it's wild overkill for most folks because most folks would never have even nearly good enough opsec for this to matter - I know for a fact that my opsec is simply not going to be good enough, I'm just not that organized. For most of us, the best approach is to just not give three letter agencies any reasons to want to destroy our lives. It's easy if all you want to do on the internet is listen to music and talk about programming.
Still, despite the fact that I don't really have any need for this, I find it to be a really fun thought experiment. And there's some pretty good talks about it, too.
That doesn't matter since you're still connected to them with your IP address, plus there's the additional problem of browser fingerprinting which alone may leak enough information to de-anonymize you and let us not even mention the lack of first-party isolation.
That doesn't matter since you're still connected to them with your IP address, plus there's the additional problem of browser fingerprinting which alone may leak enough information to de-anonymize you and let us not even mention the lack of first-party isolation. Running your own VPN is even worse since it basically links you to all of the traffic.
Given that, I would at a minimum route your network through an anonymous VPN (or two) before touching the Tor network.
It all depends on your opsec requirements but don’t be a naïve fool - Tor is not a magic anonymity service. It has pros and cons like everything else.