Googles explicit goal is to collect data about you to make money with advertizing. It works so well, Google even gives you stuff for free so you stay with them.

A privacy oriented VPN providers explicit goal is to give you some privacy, and you pay them for it.

Sure, a VPN can turn on you, but then they bite the hand that feeds them. Also, it would contradict what they explicitly say, completely unlike the situation with Google.

A Debian developer might also try to bring a backdoored package to your machine. Is therefore trusting Debian and trusting Apple the same? They are not, as Debians structure is transparent, the developers carry individual responsibility not just towards the Debian project, but towards every body that can see it, i.e. the whole world.

The theoretical possibility of multiple things being equally bad is irrelevant as long as other significant aspects are ignored.

Yeah it’s hard problem. Honestly, The small ad blocking company can sell you out to G too (as one of them did in the past).

I use Adblock VPN on iOS - it also has a dns proxy.