I finally realized where the privacy-focused marketing of commercial VPN services comes from.
Over 10 years ago, most of the internet used plaintext http and other unencrypted protocols. So someone yoinking your cookies on a public wi-fi hotspot was a genuine concern and a real possibility. A VPN does indeed protect against that. But with the switch to encrypted protocols, VPN services just kept their old narrative, even though it no longer makes sense technically.

