I think you're confusing a bunch of points together. Most people would consider "privacy" to be equivalent to "anonymity", ie whether or not your traffic can be traced back to your IP address. By and large, what services are being offered by a VPN company (and therefore what ports they have open) have no impact on whether I can trace traffic back to you through the VPN. How many customer service phone numbers my bank has is largely irrelevant to someone trying to trace my money transfers.
If your goal is privacy (ie hiding your IP address), then, umm, don't use your IP address.
Let's back up and talk about your threat model
In comments you say "I basically want to create a machine that is unhackable without social engineering" which is an almost completely separate goal from privacy / anonymity. It's also a much larger goal.
I think the first step in designing your security solution would be to decide what type and level of threat model you're trying to protect against. Some handy starter questions:
- What do you want to protect? (Data on your hard drive? Data you send over the network? Your computer against viruses? etc)
- Who do you want to protect it from? (someone who finds your laptop unlocked? Amature hackers? Criminal hackers? Nation-state hackers?)
- How bad are the consequences if you fail?
Bear in mind that the broader your threat model, the harder your job. It's very easy to say "... against all criminal hacking groups", and then you realize that even hiring a team of 30 security experts won't get you that.
To coin Mike's law of threat modelling:
The universal threat model "Confidential even against my hardware manufacturer and the most sophisticated nation-state hackers" is basically meaningless.