The malware is not an issue. But if you use a VPN and depending which one it is, they can pretty much track everything you are doing including getting your usernames, passwords, cookies, etc. Pretty much anything including your BTC address.
That and most likely if coinbase or xapo find out you have been gambling they can blacklist your account also.
Sorry but that's just not true - as long as you take care for valid certificates and https / proper encryption you are as secure as you are with your local provider.