[AndrewDMcG]

If you don't have enough control over your applications to have them connect over trusted networks and not untrusted ones, you probably don't have enough control to stop them leaking more information than you would want to the endpoints they connect to.

That's not meant to be snarky; it's a real problem. I have an android phone but I am very conscious that it's doing a lot of things I don't control and I can't really trust it.

A VPN can be part of a carefully implemented security policy, or it can be a thing that might help a little on a generally insecure base, but it can't turn an insecure machine into a secure one.