Wouldn't it just be a different type of vector in terms of being able to nail you though?

Since the VM company (unlike a VPN such as mullvad) makes zero promises with respect to keeping logs, if you visited badsite.com, then later the FBI raids badsite.com, sees a VM company IP address, subpoenas your VM company who says that your particular VM was leasing that specific IP at time XX:XX:XX, then you're done.

Further, mullvad gives you several relatively anonymous means of purchasing a VPN, whereas the vast majority of VM companies (digital ocean, linode) will require and store all manner of personally identifiable information about you.

> Wouldn't it just be a different type of vector in terms of being able to nail you though?

Quite. Depends on your threat model and what you’re using the VPN for in the first place.

Now you have to trust your VM provider, mostly US providers, that actually mention they collect some data and traffic to improve their services and comply with law.

This is true. But you can’t have an internet connection without trusting at least somebody ?