Exactly, expect that every aspect is already compromised. I'd rather trust the VPN than not having anything at all, but hacking wifi + VPN would be the best bet. Getting a VPN with fake details, paying in BTC that was tumbled and a no log company with a solid reputation is the answer