Who cares what XPUBs your wallet uses? If you're doing it right there's no difference. One could even use a non-HD wallet and then there's no XPUB to begin with. Regardless, that change is still linked to your spend, though. It's a pseudo identity.

Unless you use the VPN *on top* of Tor and not the other way round (which is a bad practice, ask the Tor devs), the VPN will gladly give the IP you're connecting from to the police. If you paid on-chain, your change is linked to it. Unless of course you trust that "no log" policies are real.

> You can pay for a VPN with Bitcoin lightning and generate no change.
Well, do you do that?

Sure, you can break the link by depositing it into Lightning, or use JoinMarket. But all of that is expensive.

> Next the monero shills will tell us that monero protects them from security cameras for their infinity fiat money lol

I don't use Monero. But, yes, if there's no trace to follow, it doesn't matter that your face got captured on camera, because no one can see where the UTXO came from. Same with Lightning, but that only works at places that take it.