Generally, no. A more reslilient network segment makes some attacks harder, but there is no magic solution to fix an endpoint which has a poor security implementation. Businesses sometimes rely on a firewall to block specific threats to vunerable nodes within their network (where software upgrades are difficult), but they use many other defence mechanisms as well.
If an IoT device does not have a robust TLS implementation (certificate pinning, etc), require authentication for all accesses, accept regular signed firmware updates, etc. then you can only assume that it is wide open. Varous organisations are working to make this easier for developers, but there is not a lot in production today except for products runing on a full smartphone-like platform. So your voice-activated hub has the potential to be hard to attack, but the nodes which it accesses are the weakpoints.
A VPN is (to a first approximation) simply a TLS pipe through which the data is passed. Anonymising the IP address where you connect to a server could break the IoT device functionality (many servers geo-locate your access as an additional security layer), and does nothing to anonymise your IoT data (which is identified by something similar to the MAC address of the endpoint)
Remember that many IoT devices have more than one radio interface. The IP port is connected to the internet by design (so a router has limited options for protecting it), and the other interfaces are equally likely to be weak.