I'd be really surprised if at least a few of them aren't run for the benefit of state-level actors.

With innocuous taps in place, most of the employees of the VPN service could even be kept in the dark about its true purpose.

Reminds me of Crypto AG: https://en.wikipedia.org/wiki/Crypto_AG