The vast majority of VPN selling points are nothing but FUD (fear, uncertainty and doubt). Security-wise, most (all?) websites you care about now use HTTPS which provides end-to-end encryption and are thus immune to malicious networks (public Wi-Fi isn't risky at all despite what some VPN ads say), and even if not, then the VPN isn't bulletproof either as it merely shifts the unencrypted traffic from your "local network -> server" to "VPN provider -> server" which might actually attrack more scrutiny from malicious actors as they've now got to only tap a single point and get lots of unencrypted traffic. Privacy-wise the biggest threats to your privacy are advertising companies and social networks, which will track you just as well if you're on a VPN based on cookies or browser fingerprinting (a VPN alone wouldn't protect you - I guess if you clear your cookies before switching to the VPN and never allow cookies to cross-over between VPN/non-VPN you might have a chance, but surprisingly this is never mentioned in any of their ads).
Not OMG SHADY! but definitely gives me cause for concern. As one comment said: "Trust and ethics are important."
This is a problem for a lot of web services. Apparently where your IP is located determines where you bank and what language you speak. Apparently people like me don't exist, or rather, are a small enough market to be completely ignored (which was the upshot of my conversation with Spotify support when I asked them to send me invoices in a language I understood, please, since they know I use the English client but send me bills in German).
So to make my life easier, I use a VPN and pretend I'm in Australia/UK/Jersey/USA/Estonia/wherever makes most sense.
I'm happy to pay for that. So far PIA have been great. They even have a good-looking Linux client that works with Wireguard.
But if there's shadiness, then I'd like to be aware of it. I was genuinely asking where the shadiness is here.