It doesn't matter where they're based. If you pay with a credit card under your real name the burden of risk is always on you and if the company has agreements with whichever jurisdiction you are in then they will collaborate with LE.

that said, trust is fickle: The ultimate example of why not to put trust in companies was WoSign/StartCom.

WoSign acquired Startcom because they were a trusted fresh player with a still untarnished name and available cheaply (also thanks to Eddy Nigg and his investor Wes Kussmaul who both saw no conflict of interest and indeed claimed in public Eddy didn't know who the buyer actually was until it was too late).

When somebody shows up with a fat cheque and tells your VPN company that Christmas came early, and that they're being bought out, then you have no reason to continue to trust or? Yet people do continue to trust (see the N.N. Taleb Turkey problem). People then are forgetting their trust assumption actually doesn't hold when main mode of growth for the company is M&A and not product development & innovation.

When trust is just a commodity that can be acquired and resold willy-nilly by some people with enough cash, then the product/service is automatically snake-oil (no matter if the crypto and the implementation of the software is 100% rock solid and was written by gods).

For VPN's a good rule is to choose a neutral company that has very little in common with you. If you are doing shit in Iran don't use an Iranian VPN company. likewise if you do shit in Russia then US/UK VPN should be safer than a VPN located in Cyprus.

If you do "shit" against Turkey, with a VPN in Australia while you are based in Taiwan that's 3 jurisdictions and much better than doing shit against Turkey connecting from Australia with your VPN based in Australia.

Finally it is best not to do shit, but sometimes doing shit is the only way crimes by governments and those in power can be exposed.