As far as I understand, a certain level of data hygiene will do wonders for even a basic setup.
For example, on our server, we have a container that maintains a kill-switched connection to a subscription VPN. Several other containers, including one with a browser, can only route their traffic through that container, and we don't use any of them for anything personal or outside their intended purpose. We basically act as if there are completely different people on that connection, like we have a secret second family. Remote activity is done through a self-hosted VPN to the home network, then VNC to the containers.
If we want to use the subscription VPN on other devices, we connect to a different location and possibly use Tor browser for extra anonymity. No activity or information overlap, ever.
Great article! I've been trying to explain VPNs to my family members for years and it just doesn't stick. I'll send this their way next time.