If it’s from a random thief, both are about equality secure, they rely on proven cryptographic methods.
If it’s from somebody powerful enough to make an ISP bend the knee, then they are equally insecure because those cryptographic methods assume you trust the underlying infrastructure. If you do not though, then yes using a VPN will help as you are adding your own level of encryption on top.
Secure against whom?
If it’s from a random thief, both are about equality secure, they rely on proven cryptographic methods.
If it’s from somebody powerful enough to make an ISP bend the knee, then they are equally insecure because those cryptographic methods assume you trust the underlying infrastructure. If you do not though, then yes using a VPN will help as you are adding your own level of encryption on top.