In the US, the ISP privacy policies say "we will collect and share everything" and US policy says "we can subvert any ISP at any time with an NSL" so it is unlikely that using a VPN over the ISP can be worse than using your ISP without one. To your point, there are better and worse VPN services. If your VPN asks for your name, address, and phone number, for example, that's a red flag. Of course they're going to see your IP addresses and DNS requests, but again, it can't be worse than your ISP. Tor can help with that. If TLS isn't broken, then neither the VPN nor the ISP can see the contents of what you send to what site. I agree if the gov'ts want to "get" someone, they can and will. But we shouldn't make it so easy.