when you use port forwarding, you're opening yourself up to a lot of malicious activity. Someone could maliciously plant some CP on your hard drive if you have port forwarding enabled.
A lot of people still don't and they use public wifi too. And some people with VPNs are using shitty ones like nord, express or Private internet access or surfshark
Surfshark and nord are owned by the same company and express and PIA are owned by the same company. So PIA isn't trustworthy anymore, their court proven no-logs policy isn't valid anymore because they got bought out since then.