It depends.

If you are targeted by any 3 letter agency this will not help/save you.

If you're worried about your shady ISP and/or other entities mining the heck out of your traffic and/or selling this data it helps.

But then you're shifting your trust from your ISP to the VPN provider. So it makes sense only if you have good reasons to not trust your ISP. Personally I only use a VPN when I'm connected to a public WiFi network.

if your VPN provider does not know who you are it's a better than your ISP.

Depending on your personal circumstances, this can be a dramatic improvement. Local ISP laws differ dramatically across countries.

VPNs won't let you evade the law, but they can reduce data footprint in certain contexts.

Many ISPs have a track record of e.g. injecting ads in plain text HTML, in the days before ubiquitous TLS.

Meanwhile, Mullvad has no idea who bought that scratchable one-time payment coupon, and we have pretty decent faith in them not logging metadata about your tracking for later study. The Mullvad server I am connecting to is claimed to be operating 100% without persistent storage.

As with most security, it always depends on what you're trying to defend against.

A commercial VPN, even a very good one is probably not good protection if you're being directly targeted by the NSA. It's very good against your ISP selling your browsing habits to advertisers. There's a spectrum between the two and it's likely decent protection for most of that.

Sure, but what if this vpn is just part of the security cascade? Like what if you go through Mullavd, another vpn, Tor, and then maybe a mesh network on top of all of this? Maybe then host another vpn through a prepaid SIM card to top?