"Coffee shop" VPNs are an excellent way to ensure your network activities and related data are properly collected and tracked and personally identified and available for logging and resale by the VPN vendor, though these collection tools do add substantial overhead for negligible security benefits. "Coffee shop" VPNs badly solve a problem that hasn't existed for a decade or so, but badly solve it in a way perfect for data collection.
One of the better-known anti-malware packages for macOS was caught collecting and reselling personally-identified metadata and web-purchasing data, and was fined. Fined not for collecting and reselling the data, but for not disclosing the metadata collection somewhere in the fine print of the end-user software license agreement. An agreement we all read fully and understand, of course.
Some of the "no logging" VPN services were caught logging a while back too, when the "non-existent" logs were found, unprotected, on the internet.
Want privacy? Enable iCloud+ Private Relay, with ODoH support.
Want security? The existing network connections are already end-to-end encrypted. Apple has been requiring that of app store apps for a while now, too.
Want geo-shifting for testing a website or a content delivery network or other such? Maybe use a "coffee shop" VPN for that, but they'll quite possibly be collecting your activities. Or you can run your own VPN server, such as Algo.
*Above does not apply to VPNs used to remotely access the internal network of an affiliated organization.