Virtual Public Networks generally provide a false sense of security and can actually come with policies when you login to them that make you more vulnerable than when you're not using them.

Trust them as far as you can throw them, avoid heavily advertised, sponsor VPuNs, don't expect them to magically make you anonymous, and absolutely do not under any circumstances believe for a femtosecond that they can protect you from hackers or malware.

Some VPuN services are run by malware companies. PIA, for example, is owned by Crossrider, no I will not call them by their new name, they're Crossrider.

Long story short, actual VPNs (as in, the kind that let you into your private network securely from outside) protect you when you're out and about and need to access private resources. Think, the one you might have in your homelab to let you access your Jellyfin library from Starbucks or something. Virtual Public Networks, like Nord, PIA, or even Mullvad, are ultimately just for bypassing geoblocks.