It really depends how much you value your privacy. If you don't want anyone knowing you run a Bitcoin node, it's probably not best to run one. However, if you are set on running one, then the next best option would be via Tor, and only risking your information being retrieved via the exit node.
However, for the majority of people running via clear net is probably okay. As long as your ISP can be trusted, which there's an argument that no third party or ISP can be trusted. It highly depends on your threat model, and who you trust. If you trust your ISP, then there's no real concerns. If you don't trust your security or your ISP security, then if any of those were compromised an attack could potentially find out you run the Bitcoin node, and therefore highly likely to use Bitcoin yourself, which could mean you become a target, theoretically.
why shouldn't you also use VPN as an additional option?
You're basically involving another third party, when you don't necessarily need too. The only way someone knows you're running a Bitcoin node via Tor, would be the exit node itself. Unless, the entity you're trying to hide your Bitcoin node activity from owns that exit node, there's no way of them deciphering what you are doing. If you involve a VPN service, then that VPN service could potentially know you're running a Bitcoin node, as well as the exit node of that Tor circuit.