There are two situations where one is genuinely useful. If you need to reach something on a private network, such as a server or a system that only accepts connections from a specific location, a VPN is the mechanism that makes that possible. And if you are working somewhere with genuinely hostile or heavily filtered networks, it provides a layer worth having. Neither describes most small businesses operating from an office, a home, or a client site.
What a consumer VPN mostly provides is a change of apparent location and a promise that the provider is not logging you. That second part is worth thinking about, because you are moving your traffic from your internet provider to a company you know less about, chosen from an industry that advertises heavily and has repeatedly been caught misrepresenting its own policies. It is not obviously an improvement in trust, just a change in who you are trusting.
The security spending that would actually help a business your size is different and less exciting. A password manager so credentials are unique everywhere. Two factor authentication on email, banking, and your domain. Keeping devices and browsers updated. A backup you have tested restoring. Each of those addresses something that actually happens to small businesses, which is credential compromise, not somebody intercepting your traffic in a cafe.
If a vendor is selling you a VPN as a security product for a small business, ask what specific threat it addresses in your situation. The answer is usually vague, which is the tell.
There is one situation worth separating from the general answer, which is public networks in places where you have no idea who operates them. The risk is smaller than it once was, and it is not zero, and the simplest mitigation costs nothing: use your phone as a connection rather than the network in a hotel or an airport. That removes the concern entirely without a subscription or a trust decision about a provider.
If your business grows to the point where staff need access to internal systems from outside the office, that is a genuine requirement and it is a different product from a consumer subscription. What that situation calls for is access controlled by identity rather than by network position, which is how modern remote access is generally arranged. Worth knowing so that the eventual need is not met by buying the consumer product a search will surface.