What does a VPN actually do?
A VPN encrypts all your internet traffic and routes it through one of the provider's servers. Nobody along the way can snoop on it (not even your ISP), and websites see the server's IP address and location instead of yours.
Normally, everyone between you and a website can observe your traffic: the operator of the Wi-Fi network, your internet provider, and anyone malicious on the same network. A VPN builds an encrypted tunnel that all of that traffic passes through. What happens inside the tunnel is unreadable to outsiders.
On top of that, the VPN server stands in for you on the internet. Websites see the server's IP address, not yours. Pick a server in another country and you appear to browse from there, which protects your privacy and lets you access content not available in your region.
What a VPN does not protect against: phishing, malware, and voluntarily handing your data to websites you log into. It is a privacy tool, not a full security suite.