Yes, CoinJoining is a good means of improving BTC transaction privacy but I don't know if you're aware that a vulnerability was detected about its service years ago,
What vulnerability are you talking about, take note that there are different CoinJoin implementations, like Whirlpool, Joinmarket, etc, which of these implementations had the vulnerability you are talking about?
and in other to prevent issue like this when privacy is the top priority is the reason why i suggested to use of 2-3 privacy service.
What is 2-of-3 privacy service, i believe you meant a 2-of-3 multisig wallet, take note that multisig set up's don't help to improve privacy, that is what CoinJoins and mixers are for.
Yes, you are right and it is never advisable to use a cryptocurrency wallet without the use of a VPN
You don't really need vpn, but to run your own node and connect your wallet directly at your own node.