Tha being said I've been quite happy with http://privateinternetaccess.com/. A good Android client, fast, don't ask any personal information when you register, they say no logging, the Android app doesn't ask any permissions and so on. I can choose the key length and additionally block all connections if the VPN is not connected.
In the general case, it's because most folks don't have the knowledge and skill required to set up either - nor should they have to.
With the increasing adoption of IoT devices and their generally crap (but not actively malicious) security, it would seem like a no-brainer for ISPs to offer VPN capability on the CPE as part of the basic service package, with UPnP configured to expose on the VPN interface rather than the public one, and with dynamic name resolution included to make configuration an easy one-time process. It'd help with customer retention, I think, and it'd surely improve network stability and throughput by reducing the quantity of attack traffic.
Because the consensus seems to be that if you use any VPN besides OpenVPN you're a moron, and therefore some build-in solutions for some OSes only support OpenVPN.