macOS ships with integrated anti-malware, and integrated malware removal tools, and other features past that including the signed system volume.
That built-in anti-malware has blocked various add-on anti-malware apps from corrupting macOS itself, not that the users of those add-ons weren’t singularly persistent in trying to assist the add-on anti-malware in corrupting macOS.
Add-on anti-malware hasn’t provided an appreciable benefit over the built-in, though one of the better-known add-on anti-malware vendors was caught reselling personally-identified metadata. And was fined. (And seemingly not a very hefty fine.) I’d assume at least some of the other vendors collect and quite possibly sell similar metadata, but they probably account for that sale better in the fine print of their respective EULAs.
For what they’re marketed for, VPNs badly solve a problem that hasn’t existed for a decade or so, but badly solve that now-non-existent problem in a way that’s perfect for collecting personally-identified metadata.
Put differently, some of the add-on anti-malware and the security add-ons are getting awfully difficult to distinguish from polite malware.
And that for no appreciable benefit to the user over the built-in security.
Outside of special requirements or endpoint security, and VPNs intended to connect into the internal networks of affiliated organizations or geo-shifting for web or CDN testing, I’d use the built-in anti-malware, and would skip the VPNs.
There are previous discussions of this topic around, as well.
