It’s mostly torrents that are dangerous without a VPN, since as a torrent user you’re also redistributing the content in question, and the peer-to-peer nature of them makes you very visible to copyright trolls.
Direct download is generally much safer. Specifics vary by jurisdiction, but in many countries merely downloading (or streaming) a pirated copy of a game or film is not a criminal offense, and is not in practice vulnerable to a civil lawsuit either.
Avoid torrents, know good direct download sites (these will vary by what content you’re interested in, look around using various search engines to get around DMCA delistings), use rudimentary privacy protections like private DNS and HTTPS-only mode in your browser, and you’ll get far without a VPN.
Tor is also a powerful, free option, but it’s generally overkill for non-torrent piracy and very hard to configure for torrents.
LineageOS is great even without root, but I still recommend using Magisk on it for system-wide ad blocking (via e.g. AdAway) if nothing else.
A banking app may have a simple root check, or a SafetyNet check. You can use shamiko and safetynet-fix respectively to fool these, both have already been linked.