Anecdata, but from couple stories from people who worked/interviewed at VPN providers - I believe that in couple years we'll start see same horror stories of private data issues, like we are having with social network and internet ad businesses today.
EDIT: apparently my anecdata is not anecdotal [0]. When it's race to the bottom for consumer pricing - your bandwith is resold (or at least there's capability to do that) for botnet purposes.
[0] https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/
The plain fact is that you don't know what they are doing, it's impossible to know.
If they ever find a way for an introspective verification/validation of configurations coupled with the connection itself (or whatever mumbo jumbo), then we can talk again about middle-men's trust.