If you have a threat model, then having both 1. no reassurance of safety in using a tool, and 2. valid reason to believe that such tools can be suspect, is equivalent to certainty that the tool should be avoided.

To give an analogy, this is similar to why "security by obscurity" isn't a valid option if you're serious about security.

Let's say that admin access is open on my server on a certain port and: 1. I have done nothing specific to secure it, and 2. it has been shown that there are adversary actors scanning for vulnerable ports on the network.

I can either take your apparent stance that "this means nothing to me", or I can consider the situation equivalent to "this server is already compromised, I just don't know it yet".

In the current conversation, the combination of: 1. no reasonable reason to believe ExampleVPN keeps your data private and 2. high incentives for adversaries to create fronts plus proof they've done so in the past, means that for people such as myself and GP, the situation is equivalent to "ExampleVPN is a front" until we have a reason to believe otherwise.

Edit: Telegram's not-really-end-to-end-E2EE would be another such example.