I think there is some muddling of the issues at hand here.
Yes, security is a process and involves situation-specific threat modeling, risk assessment, and behavioral conditioning. It is not just a 'here use %foo' band-aid. I don't think anyone here is disputing this.
But that is not the issue here. The issue is that once you've developed your personalised threat model, the issue of which specific tools to use is a very real one. OP has cast ad hominem FUD on VC, and provided no reasonable alternative, leaving someone to ask 'OK, if VC is not trustworthy, what is?' Security is a holistic process, yes, but that by definition includes tools alongside a valid threat model.
So back to the matter at hand: GPG does not provide the functionality that VC does (no FDE, no deniability), and BitLocker and File Vault are closed-source toolkits, are you really proposing them as viable trustworthy alternatives to VC? Which brings us back full circle to the original issue: if VC is deemed not trustworthy by OP, what is a user to use instead?