The problem with those reports is they still mostly come down to the auditor taking the provider's word for it. Maybe the staging environment the auditor looke

The problem with those reports is they still mostly come down to the auditor taking the provider's word for it. Maybe the staging environment the auditor looked at doesn't log anything, but what about production? Maybe it doesn't log anything today, but who says it didn't yesterday, and that they won't turn logging (back) on tomorrow? At least where I live, there is strict legislation governing what ISPs can or must collect, and what they do with that information. Offences under that telecommunications interception legislation come with prison sentences, and so there is a strong incentive for individual employees to comply. For some people, moving that exposure to a VPN provider mitigates their risk. For others, it increases it.