What do you want to protect against? If it's ISPs injecting ads into your webpages, or blackhats on the same coffee shop Wifi stealing your credit card data, then HTTPS is enough.

The one thing that a VPN can really help with is hiding your website history (as in: which domains you visit) from your ISP. However, the VPN provider then gets this full insight, so it comes down to whether you trust any particular VPN provider more with your data than your ISP.

Since HTTPS has gained wide adoption, 90% of what VPNs are advertising is bullshit. All these scare ads on YouTube along the lines of "your internet browsing is unsafe unless you go through NordVPN/SurfShark/whatever" are there because they need the subscription fees from casual browsers to offset the bandwidth costs from those customers that actually need a consumer VPN to stream Netflix from $FOREIGN_COUNTRY or do illegal filesharing.