The issue seems to be with free VPNs.

Instead, the authors recommend using paid VPNs, which are generally considered to be more reliable and secure. For example, no serious privacy or security issues were found with Lantern, Psiphon, ProtonVPN or Mullvad.

Important part from the article, not all VPNs are equal:

Instead, the authors recommend using paid VPNs, which are generally considered to be more reliable and secure. For example, no serious privacy or security issues were found with Lantern, Psiphon, ProtonVPN or Mullvad.

VPNs are not a magic bullet. They are at best a transfer of trust from your IPS - which in a lot of cases you have little to no control over and also very little trust in.

Picking a well trusted VPN can improve things, picking a bad one can make your situation worse. And there are more important things that you need to worry about first before a VPN will really help at all.