While that’s not untrue, I think one ought to be extra suspicious if you get something of value (eg VPN software that guarantees privacy and security, in this particular case), that cost the operator money but you get it for free.

Perhaps a better proverb would be: there ain’t no free lunch.