It isn't a guarantee, but not paying for software means that the developers have a strong incentive to figure out other means for extracting value out of you. So it isn't so much that paying for software wont make you the product as it is not paying for software will make you the product (note that this is when businesses are concerned - personally as an individual i give a bunch of stuff for free and i do not care about getting any value out of them, but at the same time i wouldn't build a business around giving out stuff for free).
It's just less than trivial to get it running yourself.
Reminds me I need to check in on https://Sandstorm.io and see how they're doing. I've tried to install it a couple of times and bounced off of it a couple times, not always due to things that are their fault (i.e., they do sensible things with DNS but my managed DNS provider won't let me set up the requisite records in their "easy" interface, and I'm not quite motivated to go all the way back to running my own bind).
And really paying for software is no guarantee that you won't also be the product - I'm not sure where that naive notion came from. Paying for the software isn't what keeps your privacy safe - keeping your privacy safe does. That it is an inane tautology is the point - they are separate aspects.