Protect the account as well as the connection
Where a service offers stronger sign-in protection, review it independently of your VPN settings. A VPN connection is not a substitute for protecting access to an email or app account. Keep recovery information somewhere private.