I'd dispute that most access is obtained through botnets. I see it as generally obtained through the user themselves. I will agree that the provider may not be

I'd dispute that most access is obtained through botnets. I see it as generally obtained through the user themselves. I will agree that the provider may not be clearly notifying the user what they are agreeing to by utilizing their software, hiding it in their lengthy Terms of Service, but the user is agreeing to it by installing their software and accepting their ToS. This was a huge controversy not long ago. The biggest issue I see from it is that it opens the user up to a fair amount of legal liability for what other users of the VPN service do while connected to the VPN service. If the user failed to understand what they agreed to in installing the VPN service and agreeing to it then it can make for some very awkward conversations when law enforcement comes knocking. As a cybersecurity person I also think users fail to understand what information they are potentially making available to some rando running the VPN software on their PC. I can (and have before) see any traffic that you are sending through that VPN, and potentially tamper with that traffic. If you thought Nord or PIA could not be trusted with your traffic then how do you feel about Joe Random being able to see and tamper with your traffic?