I feel like ISP-level timing attacks are a similar issue with tor, like we know the Germans can deanonymize you if they're willing to expend the effort. Not saying tor isn't better, all VPNs regardless of protocol can be forced to send in the clear if an upstream actor breaks the traffic correctly afaik as of now.

Some VPNs allow multi-hopping, similar to Tor. I couldn't give you an exhaustive list but most popular ones support this. Mullvad and Proton do, for example. There are also strategies to add noise into VPN traffic.

This is not a silver bullet, of course. Tor has similar problems as you describe if an adversary has visibility into enough nodes. As always, this comes down to your threat model.

On the one hand, I find the advertising of VPNs outright dishonest. On the other hand, I would trust any reputable VPN provider much more than I trust my ISP or cell carrier.

The main defense against VPN timing attacks is to ensure your VPN exit node isn’t somewhere that the same person would have access to as your connecting IP.

That said, if someone runs a website or service where you have a unique login or custom token and they have access to your ISP’s connection logs… a standard VPN will once again give you away. This is why TOR exists.

I generally argue that an exit VPN doesn’t really provide much privacy; the only real services it provides are georelocation and protection against low effort bulk filtering (eg, identifying torrenters or bulk metadata collection).

For everything else, either encryption and third party DNS is enough, or the exit VPN isn’t enough to stop targeted surveillance.

https://mullvad.net/en/blog/introducing-defense-against-ai-guided-traffic-analysis-daita

Also, if you have a limited RAM smartphone and your VPN is operating in userspace, then all it takes is for one really large image to grace your smartphone screen for your OS to go into out-of-memory kill mode. What's it going to kill? The foreground app you're trying to use, or the background VPN app.

In my experience, the VPN goes down before the browser does. Mounting a swap on your phone is not the worse solution against this, but the UI starts to get really unresponsive.