> They don't have as much of an incentive to invade your privacy as your home ISP does

The have a much better opportunity of correlating traffic than anyone else. It's not separated by an IP anymore. They've got a specific account they can connect to a specific person. (via billing) I believe if they wanted to sell the traffic logs, they'd easily find customers.

Also there have been companies like Hola (https://torrentfreak.com/hola-vpn-sells-users-bandwidth-1505...) that do outright evil things just because you run their software. Facebook bought Onavo VPN which gave them more traffic visibility.

There's also a few VPN services which will replace / inject ads into pages you visit without https.

So yeah - a lot of reasons to invade both your security and your privacy here.