They are used for security, but VPNs don't magically make things secure. In the industrial control space VPNs are considered risky because a remote device can be compromised and access everything else on the same VPN. Separate networks, VLANs, firewalls and other security approaches are used before hitting the problem with a VPN hammer.

It depends a lot on what you're using it for.

For your typical home user that bought a VPN because a YouTuber promised them extra security and privacy, no. They're gaining next to no security unless they have a malicious ISP that injects content into HTTP connections.