Yeah, but you do not get privacy with The Tor Broswer, but instead anonymity.
With a VPN you don't get anonymity, but instead privacy.
There is a technical difference between the two, and it matters in cases where people are very interested of their digital footprint.
VPN and the TOR network can be combined too.
I'm not sure if anonymity and privacy is not the same thing, but security is another mayor aspect, besides privacy.
there certainly is a huge difference between anonymity and privacy, i just wanted not to use a lot of jargon.
privacy is more about staying "low-key" to most of the internet, not having your data logged/stolen etc. and trying your best not to be traceable to an extent (very big oversimplification though)
anonymity on the other hand, is about having an internet identity completely untraceable to all actors including the website owners, your isp, the government, and other various threat actors
for example, TLS is one of the protocols used on websites to partially encrypt your traffic, that would be privacy instead of anonymity, because while it encrypts your actions on the website itself,
your IP is still visible by the TCP handshake being made to the website (which is able to be read by anyone really), they just dont know what you've been doing on the site.
VPNs are mostly used to only hide your IP address from other users of the internet. while your IP is safe to other users, it doesn't mean it is safe to the company managing the VPN, most VPNs are required by law to store logs of all your connections and requests to websites so when law enforcement wants something, they knock on the door of the company and it gladly complies and gives all your data to them (perhaps because it was a honeypot in the first place).
VPNs that
claim they don't do this are called no-log VPNs, regarding this, i would recommend mullvad, its cheap and reasonably trustable unlike proton and other shilled VPNs like NordVPN
however nothing can really cover up your own mistakes, when darkweb website owners got caught it wasnt because of using tor, it was because they did small stupid opsec mistakes just like mr. conor fitzpatrick, a hacking forum owner...
If you need to go ultra schizo then i recommend using tor + renting a residential VPS, a VPS doesnt get detected by filters that block all connections to tor users and a lot of the fraudsters and hackers use a setup like that. alternatively proxychains + tor + multiple residential VPS but that would be kinda overkill.
For starters, the biggest security upgrade for windows users, is to upgrade to Linux, since it's way less targeted. From there, the more simple your system is, the less attack-able surface there is.
I agree with the second part, as for the second part, theres really tons of reverse psychology on this topic, using Linux would make you stand out more as you would be seen as an individual who cares about their privacy or is generally technically enclined (obviously Linux is still used by 99% of servers but the fingerprint is different). I'm sure the governments etc. all have 0 day exploits on Linux, but in general, you shouldn't be worrying about that if you're not a huge threat to them. But yeah if we're only talking about security then Linux is a good start, user friendly distros are more hardened than windows but still are not perfect, even the most barebone distros like gentoo still have people trying to harden it even more.