Agree, but: Most free VPNs are run by state-owned actors, may also in fact be honey-pots, which are now dripping with meta-data for literally everything you do on the Internet. Whilst that is not strictly worse than MiTMd HTTPS, it is still a step in the wrong direction.