A VPN isn't itself secure. It's only a secure tunnel. If the VPN's exit is insecure, then you're insecure. DNS-Over-HTTPS hasn't reached ubiquity yet but VPNs are very useful but are having a reckoning with serverside attacks and governments demanding "oversight" and backdoors (like the recent move by China on foreign owned but China-located companies VPN usage).