Not necessarily compromised, I saw a VPN provider (don’t remember the name) that offered a free tier where the client accepts being used for this.

And I suspect that in the future some VPN companies will be exposed doing the same but with their paid customers.