VPNs are good for circumventing censorship and geoblocks. The internet in Russia is severely broken without one right now. But that's it. Those who market a commercial VPN as a privacy tool are severely misrepresenting it, to put it mildly.

In my own opinion, an operating system should not make its own network requests, period. Maybe some update checking when the user intentionally wants it to happen. But modern Windows straight up behaves like malware. I have ARM Windows 11 on a VM. I deleted Windows Defender, Edge, telemetry services and the updater to make it usable. Not all the cutesy group policy registry things, no, I used the recovery mode command prompt that ignores NTFS permissions to delete these files.