A VPN does one thing well. It encrypts the traffic between your device and the VPN company's server, and it hides your real IP address from the sites you visit. That is useful on hotel Wi-Fi, or when you do not want your internet provider seeing which sites you use. The marketing tends to promise much more than that.
First, a VPN moves trust, it does not remove it. Your internet provider can no longer see where you go, but the VPN company can. A no-logs promise is only as good as the company behind it. Independent audits are a better sign than a slogan, and a free VPN has to make money somehow, often from the data you were trying to protect.
Second, most of your traffic is already encrypted. Almost every site uses HTTPS, which protects what you send to it. On a public network, a VPN mainly hides which sites you visit. It does not add much protection to your banking session, which was already encrypted.
Third, a VPN does nothing about tracking. Cookies, logged-in accounts and browser fingerprinting identify you whatever your IP address. If you are signed in to Google or Facebook, changing your IP does not make you anonymous to them.
Fourth, it does not stop the attacks that actually get people. Phishing emails, fake login pages, malware and reused passwords all work exactly the same over a VPN. A password manager and two-factor authentication protect you far more than any tunnel.
Fifth, VPNs can leak. If the connection drops and the app has no kill switch, traffic goes out unprotected. DNS requests and WebRTC in some browsers can also reveal your real address. Good apps handle these, but it is worth running a leak test after setup.
The short version: a VPN is worth having for public Wi-Fi and for keeping your internet provider out of your browsing, as long as you trust the provider. It does not make you anonymous and it does not protect you from phishing or malware. Get the password manager and two-factor authentication sorted first.
