Working as an IT Professional, and attending various govt agency security briefings, you are not paranoid. Its bad out there.
But a VPN for a typical end-user doesn't accomplish anything significant. For monitoring of traffic, you move an interceptor from targeting the ISP to the VPN provider network. 6 one, 1/2 dozen the other. nothing material accomplished for most folks' home computers. And if you are paranoid, how do you know which VPN provider will protect you vs being the compromise itself [believe me, if I was a nation-state cyber unit, I'd offer a commercial VPN service. why go to effort of hacking, when you can get your targets to come to you?]. And no VPN will help if your computer itself is compromised [which is relatively easy to do]
The real answer gets complex, with lots of 'it depends'. a blanket statement of everyone needs is objectively (factually) false. Would folks benefit from 'safe computing' practices? sure, but way more involved/complex than simply using a VPN. For example, most folks don't use Private/Incognito modes (which have their own limits), so real easy to track most people's traffic through ad networks, regardless of VPN usage.