Everybody is right. It doesn't have to be either-or.

You can select a paid VPN service that helps protect you from specific adversaries. You can roll your own VPN on your own VPS that helps protect you in some use cases.

You can, and should, advocate for good privacy policy.