Considering the low barrier to entry, I would say that most of them are just run by dilettantes wanting to make an easy buck, but that amounts to the same thing

Considering the low barrier to entry, I would say that most of them are just run by dilettantes wanting to make an easy buck, but that amounts to the same thing because an intelligence service would be able to have their way with the infrastructure of just about any commercial VPN provider. My thought was to sell a VPN-business-in-a-box where you plug in your domain name, AWS creds, and payment details and in exchange you get a fully built VPN business including a web site, VPN nodes, iOS app ready to submit to Apple, and so on. Just add customers...