A privacy oriented VPN providers explicit goal is to give you some privacy, and you pay them for it.
Sure, a VPN can turn on you, but then they bite the hand that feeds them. Also, it would contradict what they explicitly say, completely unlike the situation with Google.
A Debian developer might also try to bring a backdoored package to your machine. Is therefore trusting Debian and trusting Apple the same? They are not, as Debians structure is transparent, the developers carry individual responsibility not just towards the Debian project, but towards every body that can see it, i.e. the whole world.
The theoretical possibility of multiple things being equally bad is irrelevant as long as other significant aspects are ignored.
I use Adblock VPN on iOS - it also has a dns proxy.
They have a build on the web; I compiled my own off of their source, though, so can't vouch for that.
Is there any other option?
It can leave connection open which prevents many cellular radio technologies from falling into lower power state.
Really depends on how optimized the cell modem is and how often keepalive packets are being sent by the VPN. Honestly, I haven't seen too much of a battery hit on ipsec VPN on the iphone SE. However, my older android phones used to get shredded on OpenVPN.
EDIT: If anyone's asking, I use the algo.sh script to deploy ipsec vpn on digitalocean (has option to enable adblocking too) https://github.com/trailofbits/algo.
It's designed to not use persistent connections, keepalives may have to be enabled in case of nat traversals though (to enable incoming packets).
I highly recommend an ad blocking VPN so rest of the apps hitting G ad network are blocked as well.