Although paying for an audit could be interpreted as conflict of interest on the auditing side.

Perhaps the users should pay for an audit as in "Check this one for us!"

Question is, how that could be organized. I guess the user community would have to unite for it andthe VPN provider would need to declare ahead of time, that they are fine with being audited by an independent party, paid by the customers.

Reputable auditors care more about maintaining their reputation that pleasing a small client. Obviously nobody would trust an audit by the owner's cousin, but an established cybersecurity firm should be fine regardless of how it is funded.