This isn't Mullvad's fault -- it's a challenge with the VPNs-as-a-privacy-service architecture generally, something we wrote about here: https://invisv.com/articles/relay.html

VPNs are great when the network you're on is less trustworthy than any other network you have no visibility into, such as in places where the network is heavily censored or otherwise restricted. They're also widely used for evading country-level streaming restrictions. But VPNs aren't really the right architecture for privacy more generally.