Choice? I don’t use one but that’s due to never exposing ports that don’t need to be. Some that do that would still want one to provide “belt and suspenders”. Others want a specific one vs another primarily due to the software they use, that others do not. Given how trivial it is to install one does it really matter? I’m fine if they do as long as it is easy to remove, i.e., not a critical system/global dependency. I always install and remove some anyway, don’t you?

Keep in mind that you need backups perhaps moreso than you did when using OneDrive - 3-2-1 being robust without going crazy.

Ditto VPN vulnerabilities. Belt and suspenders can help though if a remote is compromised likely all the things it uses will be, if not immediately then eventually.