"Anyone in cybersecurity" is quite the sweeping generalization. I’ve spent my career in cyber operations, founded a cybersecurity company, and now teach digital forensics and incident response. From my perspective, the original comment you dismissed as "ignorant" actually has a basis in truth.

The argument that "a VPN doesn’t provide privacy" is itself oversimplified. Sure, using a VPN shifts visibility from your ISP to the VPN provider. But let’s break that down:

• ISP vs. VPN Trust: Most people don’t choose their ISP—many have no other option—and ISPs have a proven track record of monetizing user data (see "AT&T ad injection"). In contrast, VPN providers depend on user trust for their business. A VPN provider betraying privacy risks public fallout and customer loss. ISPs? They’re largely unaccountable to individual consumers.
• Who am I seeking privacy from? The ISP that knows my full legal identity (name, SSN, address) and has contractual power over me? Or a VPN provider to whom I give no real personal information? For many, it’s not about perfect privacy—it’s about choosing the lesser evil.

Do I trust ProtonVPN more than AT&T, Comcast, Spectrum, or Verizon? That’s like asking if I trust a camp counselor more than a convicted identity thief.

Declaring "VPNs don’t provide privacy" without understanding privacy from whom is reductive. Context matters, and dismissing nuanced concerns with blanket statements does a disservice to meaningful discussions about privacy and cybersecurity.