People expect the personal VPN to hide or otherwise obscure what they are doing on the Internet. Some are better than others, but it is difficult to evaluate them on technical merits. Duo Labs provides guidelines on how to pick a personal VPN that matches your threat model.
Security debt is the accumulation of the patches missed, the risks accepted, and the configurations misapplied. Many enterprise security problems arise when the bill comes due.