Ditto VPN vulnerabilities. Belt and suspenders can help though if a remote is compromised likely all the things it uses will be, if not immediately then eventually.

1.1.1.1 does no filtering. 9.9.9.9 does, similar to 1.1.1.2. To skip filtering use 9.9.9.10.

I expect they think that a significant percentage of people that have Internet also have a smartphone. They probably aren’t far wrong.