If you trust your ISP to examine all your web traffic, and if you don't mind every site you visit knowing your real IP address, and if you're not worried about hackers and sniffers on public wifi stealing your data, then I suppose you don't need one.

But if by overrated, you mean they only handle certain aspects of security and aren't a complete solution by themselves, then I agree. But no one who understands VPNs expects them to be a complete solution by themselves.