Yeah, but at least there haven't been any (high-profile) abuses, yet. Meanwhile Verizon and now Comcast have been caught tampering with their customers' traffic, and those are probably just the well-publicized cases. Maybe I am just blissfully unaware of VPNs' shenanigans.
Cox injects HTML into your HTTP connections. I've recieved popups on pages saying they've spotted traffic from a botnet server over my connection, and that my computer may be infected. I talked to Cox support and they view it as a feature.