It's because the primary function of VPNs isn't privacy, it's to connect to a remote network and treat it as your LAN. Any privacy or security stuff is completely orthogonal.