The solution is to raise more public awareness of VPNs, and their benefits.
Also, automating the setup of self-hosted VPNs (like OpenVPN) on a home machine (like a Raspberry Pi plugged into the router) would go a long way. I personally prefer not to use third-party VPN providers, as I don't really know whether I can trust them.
Trusting the link layer is an unnecessary band-aid. It doesn't need to be trusted, and you should always operate with the assumption that it's not trusted. Only trust end-to-end encryption and authentication.
Your second line steps toward security absolutism, since it just pushes out the trust boundary one step further and requires even more technical expertise to be actionable, especially in contrast to using a VPN provider.
The advice to only trust E2E encryption is only useful if you trust both the E2E service provider and the implementation, especially where the service provider owns the only compatible implementations, and the implementation is closed source.
The recent observations that FB could, either willfully, or under coercion, completely undermine their E2E implementation illustrates that, in general, solutions that are user friendly, readily accessible, and operating at scale, are subject to manipulation for economic, law enforcement, or political reasons.
Perhaps using a VPN prevents them from logging your IP address. But they still have your username that you logged in with, your phone's device ID, your session cookies (which were created when you were at home on WiFi), your browser's signature, etc. Again, using a VPN isn't going to stop any of that.
The likely outcome of using a VPN is that Facebook's analytics will know exactly who you are, but their global rate limiter will cut off your access because your IP address is now shared with a thousand other people, some of whom are using a VPN to spam them.
The OPs point is, at some point in the chain you have to trust someone and in his opinion coffee shops are less likely to want to do bad things with your WiFi connection than VPN providers et al. Which I think is a fair point when you look at the costs of scale. ie it’s easier and cheaper to set up a rogue VPN provider or boobytrapped installer than it is a coffee shop.
Personally though, the reason I don’t connect to random WiFi networks is most of the ones in the UK ask you for your email address. I’d rather rag my mobile data allowance than hand my email address over to 3rd parties.
This is why I have a few spare email addresses that I don't log into. They have no personal information about me (most of these mailboxes were last accessed on computers I don't have anymore or via the public library).
That said, things may have improved in the last couple of years...
There is still the rest of the internet, like the part between Cloudflare terminating SSL, and the backend on shared hosting, running bare HTTP. Point being that if you're using sites that are lazy about transport security, no VPN will help you.