You can thank the pervasive advertising of services like NordVPN and their owned subsidiaries for that. Loads of people have been advertised to thinking that using a VPN is "more secure", but this new colloquial understanding of a VPN is quite different from the true definition. I've had to have talks with numerous friends and colleagues dissuading them from purchasing these, including saving someone from a multi-hundred dollar NordVPN subscription because they wanted to be more "secure".

As an aside, viewing an HTTP website over VPN is indeed useful when the threat actor is the public WiFi provider, but it doesn't if your threat actor is the VPN provider, or in between the VPN provider and the hosting provider. I'll cede that this is beyond the scope of the situation talked about in the article though.