It's really not the "third parties" to blame here for the most part. You can make a viable business from selling a VPN service in exchange for money with a contractual requirement that you be respecting privacy in particular ways, so that you can actually get in trouble for not doing it.
But when Shady VPN Corp. starts offering the "same" service for "free" under a different contract because they're logging everything and selling your data, and then all the customers go over there because who doesn't like a free lunch, whose fault is that really?
Of course it is. But it's also the case that doing the opposite of whatever idiots do isn't necessarily smart.
It's like the thing where people say don't use Google because "if you're not the customer you're the product" but then the same people are pushing Microsoft products that not only charge you money but then still do the same thing as Google or worse.
If you're not paying them then you can guess how they're making money, but just because you are paying them doesn't mean they're not doing the same thing. You still have to read the fine print.
https://arstechnica.com/gadgets/2017/05/how-to-build-your-ow...
Do you think it's possible to have real privacy/security for someone who faces state suppression a la Edward Snowden?
https://github.com/pivpn/pivpn
Wireguard is faster & easier to set up for mobile devices.
of course, if you want "absolute" privacy and security, NONE of these VPN companies will fit the bill