The software isn't anything special, and the hardware and network connections to actually run the VPN are probably a very small part of their margins - certainly not worth nearly 1 billion dollars.
Just the sort of thing you see in the real world. It's much easier to lock down access for a network with less people using it.
A network with more people starts to find all the edge cases where your lock-down rules break legitimate things, which results in calls to your boss from people with the clout to make you change stuff.
Similar for reporting, alerting, etc. Volume and variety of traffic can force you to be more lenient in larger networks. Or lose any real effectiveness because your signal/noise ratio is now bad.
Execution is everything. And there are no guarantees when it comes to execution. That’s what the cost of acquiring an otherwise “simple” business is: the cost to guarantee successful execution of a business/product plan.
You're suggesting that either ExpressVPN was a really good business with sophisticated secret sauce, strong technical chops, and capital assets probably worth $1B (validated by people with lots of money being willing to pay for it), or that I and other HN commenters are wrong about the sophistication and it's really worth peanuts because OpenVPN can be run on most routers or any Linux box.
The latter is obviously false, but the former is not necessarily true - instead, what I and other users are pointing out is that they're really selling is their users, and implying that the buyer expects to be able to extract more than $1,000,000,000.00 of value from them. As you pointed out, you see this sort of comment when a social network or many other kinds of startups with lots of users are sold.
The point is that the users are the product in this transaction.