Instances are only as safe as their admins and providers are. You can see from the hacked instances the other day that some basic steps such as not using the same account for admin use and normal use are pretty alien to new lemmy instance owners. If they fail that - well that doesn't bode well. Years of reddit means safety isn't on your mind if you are not already doing tech work.

And lemmy is only starting to beef up security. At some point lemmy will be hardened against attacks. And admins that have run their instance for years will have their security practices. But let's face it, it is still alpha software.

Tor and VPN should not be used together, you have to pick one. And i'm comfortable with tor.