It should continue to be until September, but it's not safe to keep using V2 addresses. At this point it's safer to use clearnet with a VPN for IP masking.
Probably not such a great idea. V2 addresses are not critically insecure, they're still okay for normal use but their end of life is long overdue. V3 is of course better, but I'd rather stick with Tor than use a VPN.
VPN is okay if you want to obfuscate your traffic from your local ISP. But the VPN provider will be able to see your traffic and do some fingerprinting as well, if you use their proprietary apps. There is still a potential for them to be keeping logs or are corporative with any mass surveillance. Besides, Tor bundles a nice browser with sufficient privacy measures as well.