[yegor]

You're not wrong. All of those are possible. However some countries are better than others for some points you raised. For example, Canada has no NSL (National security letter) equivalents. We cannot be compelled to covertly log some/all of our users with the current laws on the books. Of course this can change in the future.

Shady businesses are out of scope when it comes to laws, but that's true for any industry. There are ways to protect yourself, if your opsec warrants it, by "double wrapping" and using 2 separate VPN providers simultaneously.

Greed is also a huge factor. Dishonest providers can implement all kinds of SDKs into their software and 2-3x their revenues. This is why its important to use VPNs that offer open source apps you can audit and compile yourself which would protect against some obvious violations, but one can do all kinds of evil shit server side without the end user ever knowing.