I think the problem is you’re trading one set of untrustworthy actors for another set of lesser known untrustworthy actors.
As for the public wifi, i get that i can't trust my random Dropbox VM for example, but i can surely trust it more than an actively hostile public wifi, no? If i can't trust any remote computing VM, how can i host anything on infra i don't own?
It took a lot of explaining to my parents why a VPN didn’t add any meaningful security for them.