Here are my answers as someone who exclusively uses Usenet.
You'll want more than one provider on different backbones - that way if one is missing something, the other may have it. I've had good luck with thundernews. This is your subscription/primary provider. You'll also want a block provider. Unlike the subscription provider, block providers are literally what they say on the tin - buy a block of data to download and if it takes three months, fine. Two days? I'd revisit your choice for a primary provider, but whatever when the block is gone, it's gone.
There are speed limits and multiple thread limits that determine how fast you can actually download things. Stuff is taken down, but it's rare. The lowest hanging fruit for content protection is torrents rather than big servers somewhere.
I'm very meh on Usenet+VPN. Unlike torrents, you aren't sharing anything so your IP isn't advertised to those content protection folks leeching on a magnet/torrent dl. Secondly, as long as the providers use SSL, the actual content is encrypted from your ISP.
Something that you didn't mention, but needs addressing - indexers. Yes, there are free indexers but they're often capped at a certain number of grabs per day. Expect to pay for access to these as well - but some have lifetime memberships at a reasonable price. Get more than one and sabnzbd can prioritize by user-assigned weight. (By the way,these are typically what gets hit by content protection/LE). Indexers provide the nzb files that tell you download client where in the providers' server to find the download bits/bytes.
The *arr stack works wonderfully with Usenet, I think if you go this route, you'll be surprised how little you have to fall back to torrents.