To be fair: Using SOME (malicious) VPN can bear immense risks.

Instead, the authors recommend using paid VPNs, which are generally considered to be more reliable and secure. For example, no serious privacy or security issues were found with Lantern, Psiphon, ProtonVPN or Mullvad.

I'll never understand the thought process that leads someone to use a "free" VPN...

I expect that paying for a VPN would be a risk too if you live in a country where your bank reports on your purchases to your Govt. True anonymity is challenging.

The issue seems to be with free VPNs.

Instead, the authors recommend using paid VPNs, which are generally considered to be more reliable and secure. For example, no serious privacy or security issues were found with Lantern, Psiphon, ProtonVPN or Mullvad.

Important part from the article, not all VPNs are equal:

Instead, the authors recommend using paid VPNs, which are generally considered to be more reliable and secure. For example, no serious privacy or security issues were found with Lantern, Psiphon, ProtonVPN or Mullvad.

VPNs are not a magic bullet. They are at best a transfer of trust from your IPS - which in a lot of cases you have little to no control over and also very little trust in.

Picking a well trusted VPN can improve things, picking a bad one can make your situation worse. And there are more important things that you need to worry about first before a VPN will really help at all.