You are welcome to scan my public IP. There are bots scanning it every few seconds. If there was a vulnerability it would be exploited in the matter of a few minutes.

Also, you have no way of knowing who is behind a website. That's why web browsers have strong security mechanisms. It is by necessity.

VPNs do very little. However, VPN companies want to keep up the fear mongering to make money.