We take steps to reduce the amount of trust required, such as splitting that trust across many parties, so any one party hopefully can't betray us enough that it matters or that we don't notice, but there's still a lot of trust. For example, we use SSL certificates and certificate authorities that are known ahead of time to protect from problems on the network, but that requires you trust your OS and/or your browser, which is generally how you receive those certificate authorities. If I'm able to get my own CA on your system and trusted, and I can see your traffic, it doesn't matter whether you're using HTTPS connections.
A VPN provider might say they're not keeping logs, or that their servers are not beholden to a third party and traffic is not being analyzed, but ultimately all you have is their word on that. Ultimately, the only thing different between you connecting to the NSA and routing all your traffic (even if your traffic is mostly encrypted) through them so they can look at it and a VPN provider is that you trust the VPN provider when they say they aren't the NSA and they aren't looking at your traffic.
I wouldn’t blindly trust CAs either.
There's DNS and root servers to consider as well (but that might be harder to hide with all the caching going on).
I almost edited my above comment a few minutes afterwards to append something like "and honestly, it would be pretty hard to convince me the NSA or some other group hasn't run one or more VPN providers in the past. The only question in my eye is whether it was a popular one or not."
Or have we already forgot about Zoom's "end-to-end encryption?"
Unless you're continuously verifying, this requires trust that it is built that way and/or won't be changed in the future.
That's like saying: "you really really need to trust a Bitcoin miner"
I'd hope the VPN service is built and operated in a way that doesn't require trust, but provides the same level of security.
edit: Since there is confusion in the responses. I'd prefer to trust no-one.