The pitch is presumably "to hide your traffic from CoffeeShopSSIDThatMightBeMITMingYou, route it through a Google-VPN-that's-logging-everything-but-at-least-not-injecting-malware".

Technical users like you and I can already set up our own VPN-server-that-logs-nothing. This would serve the needs of others, who currently have the options of (a) be MITM'ed or (b) get scammed by some shady offshore company because it was the first search result for "vpn service".

Isn't the whole point of validated HTTPS that it protects you from MITM attacks? (barring shenanigans like Lenovo) And if somebody MITMs my regular-HTTP connection...well then, oh no I might see ads instead of the blog I wanted to read.

Or, you know, redirect "http://bank.com/login" to "https://bank.com.totally.not.phishing.you.co.za".

That pitch is too obscure to work legitimately with most users. Hence, they will cajole users that don't understand the privacy tradeoffs through the VPNs in some other way (very much in line with their current behavior).