Point taken, but your ISP cannot middleman a connection between you and a hidden service given a proper configuration. Likewise, a VPN provider cannot theoretic

Point taken, but your ISP cannot middleman a connection between you and a hidden service given a proper configuration. Likewise, a VPN provider cannot theoretically see your encrypted TOR traffic, but there are many caveats to this and a feeling of real security is only deserved if you pay attention to your opsec and browsing habits. For the average, uninformed user, I rest easier at night recommending a direct connection to TOR. One less party to worry about. Security by obscurity is more of an afterthought and shouldn't be relied upon. The relative I mentioned was using a pretty shoddy VPN that I won't name here, but I definitely don't trust them. Of course, with a network as diverse as Tor, one user's threat model will vary significantly from another's. For example one might be chiefly worried about deanonymization while another might be more concerned with timing attacks. For some of these use cases, having a VPN layer is pretty reasonable, but for others, potentially detrimental.