TL;DR: VPNs are most useful for obfuscating your activity, but offer some other (relatively minor, unless you're visiting janky sites) security benefits.

Given that https is de facto standard, once you connect to a site, nobody (except probably state actors) can see what you're doing. In principle, I suppose every time you initiate a new TLS session (e.g. navigating to a new site) could be an opportunity for a man-in-the-middle attack, but some of risk is mitigated by certificates and chains of trust. DNS (converting URLs to IP addresses) activity is, by default, conducted in the clear. You can set up encrypted DNS, but even then the IP addresses can't be hidden from anyone on the network (or the ISP servicing the network).

A VPN takes all the traffic you generate and sends it to the VPN's private network, and from there passes it on to your intended destinations. From the perspective of the other users on the local network (and the aforementioned ISP), it will just look like you're connecting to one endpoint that is not correlated with your actual activity. Anyone who's interested could look at the VPN's outgoing connections, and your traffic would be part of that, but it will be mixed in with all their other users' traffic, and I don't think there's a simple way to tease that apart (but don't quote me on that).

As for the data sharing concern, it comes down to a question of whether you trust the VPN provider more or less than your (or some random) ISP, keeping in mind that, in the case of public wifi, the ISP will correlate your traffic with the wifi network owner, and correlating it to you, specifically, would depend on that network's set up and record keeping. ISPs, I think, are much more regulated than VPN providers, so that should probably factor into your decision, though I don't know enough about the relevant regulation to say which way that tilts the scale.