They protect against ISPs. My ISP, Comcast, regularly and as part of it's policy performs man in the middle attacks on subscriber connections in order to insert malicious javascript into user requests from 3rd party websites.

If hiding from your ISP is your threat model then a VPN is fine. It'd be better to use individual per-application tunnels though so you can still host servers with your ports locally and participate in the internet as an equal. Using a full VPN you rent prevents that.