a vpn company is a paid for MITM attack surface.

(Carl from Obscura here)

I totally agree for traditional Single-Party VPNs, which is why we are a Two-Party Relay. More here: https://obscura.com/blog/bootstrapping-trust/