Your understanding is correct. Approximately no websites or apps expect (or accept) passwords over plain text anymore (though there are a few exceptions, such as email servers and routers or other embedded devices). Treating a VPN where you don't control the server as a potentially-hostile network is the right move, but protocols intended for security even on hostile networks - such as the TLS protocol that underlies HTTPS and most other network encryption these days - are fine (so long as they're used correctly, validating the server certificate and so on).
The main ways a VPN can be more secure than not using one are:
- You hide your location from the server you're talking to. This isn't perfect anonymity by far, but it helps.
- There's basically nothing people on your local network can do to attack your traffic - even unsecured traffic - without first breaching the VPN. Since a local network is often in an unsecured location like an airport or cafe, and people might be looking around in real life to see who they can attack, there can be some advantage here even if the VPN provider is merely untrusted (as opposed to known malicious).
- It's possible to hide servers (or other hosts) such that they're not available on the public Internet, and only on the LAN. A VPN can let trusted clients - but nobody else - onto that LAN from anywhere.
On the flip side, a VPN server has a guaranteed man-in-the-middle position on your connection. So, anything that's vulnerable to MitM attacks (anything plain text, some weak old versions of SSL/TLS, some software and protocols that have weak security) can be carried out by the owner of the VPN software. Doesn't mean it will be, though; after all, the owner of the router in any public Internet access network has the same position, and most of those are fine.