Ask HN: How can you know if VPNs (e.g. Mullvad) are legitimate or gov honeypots?

I just assume they are, but my threat model isn't trying to defend against state-level actors, which I'd guess is near to impossible. Since my TM is my data thieving ISP, a VPN works well for me.