At this point the access points and the global data and surveillance system is too complicated and interconnected to dis-intermediate the access point and the network itself That is to say you cannot even connect to IP addresses unless you’re already part of the global whitelist for APs Try yourself. Get a VPN and then connect from certain regions and to won’t get very far and you’ll be slooooow You’ll say, oh, that’…
It all depends what your privacy threat model is. There are very few organisations capable of identifying the human user behind a Mullvad connection with a VM. If you're worried about local law enforcement or advertisers it's probably enough.
We're currently relying on AS' who 'play ball' with anonymous users, but that's not a requirement for AS operators by any means.