Can second the recommendation for the Mango travel router. I always prefer to take the VPN out of the “hands” of the client device to avoid any leaks. With 2 such devices connected via Wireguard VPN any other device I connect to that client router’s WiFi is safely communicating through that VPN. A sort of site to site VPN that works for devices that could never otherwise use a VPN client.

But of course this is a different use case and not always an option. Not if you want to use Tailscale. Probably unless that Apple TV is already connected to one of this “VPN WiFi” with Tailscale on top (no idea what the functionality or performance impact is).