Just a note that there are many solutions for automated installation of VPN on home machines. HomelabOS (https://gitlab.com/NickBusey/HomelabOS) is one of them, Algo (https://github.com/trailofbits/algo) is another.
The OPs point is, at some point in the chain you have to trust someone and in his opinion coffee shops are less likely to want to do bad things with your WiFi connection than VPN providers et al. Which I think is a fair point when you look at the costs of scale. ie it’s easier and cheaper to set up a rogue VPN provider or boobytrapped installer than it is a coffee shop.
Personally though, the reason I don’t connect to random WiFi networks is most of the ones in the UK ask you for your email address. I’d rather rag my mobile data allowance than hand my email address over to 3rd parties.
This is why I have a few spare email addresses that I don't log into. They have no personal information about me (most of these mailboxes were last accessed on computers I don't have anymore or via the public library).
That said, things may have improved in the last couple of years...