its why the research part is important. the ones that dont for example may have appeared in court for a hearing by some body of government and had nothing to show in court.

also keep in mind, privacy from government and privacy from corportations can be two seperate usecases. the people who want privacy from government tend to avoid five/nine/fourteen eye hosted servers. ones who want privacy from corporations (usually piracy) only care that the vpn in question does not forward C&D/reveal adress to corporate, or keep logs(as well as support port fowarding)

a paid vpn of course can also sell data. so do dillgence on choice.