Anything and everything depends on the threat model. Often, a popular and trusted VPN is the first and necessary step to hide in the crowd and drop your most logged geo ID, which is the endpoint IP.

Additional measures are certainly required.