VPNs aren't secure end-to-end. You can still have your connection spied upon and/or hijacked in the link between the VPN gateway and the website servers (including by the VPN operators themselves!).
Sure the client has encryption (most VPN clients do), but that's just up to their servers. From the PIA servers to the final web server, there's no extra protection, so if you're accessing an HTTP service, it's unencrypted.