Security is a battle with convenience. Sure, it's technically possible for someone to pull off a MITM attack on someone using a VPN; perhaps there's an attack

Security is a battle with convenience. Sure, it's technically possible for someone to pull off a MITM attack on someone using a VPN; perhaps there's an attack vector before they establish their VPN connection, or they've compromised the server running the VPN service, etc. But that's probably only a threat to government agents and Snowden, whom have real fears of targeted attacks like that. For the layman, VPN pretty much is a magic pixie dust that will let you browse unencrypted websites with confidence that the pages won't be modified, and your form submissions won't be sniffable on your public network. Of course, it won't protect you from sites that already have malware on them.