If you’re not relatively tech savy, a typical VPN IS the man in the middle. That’s the problem. A VPN, in itself, is very good. But as you said, non-tech savy users won’t be able to set up a VPN themselves, so they need to trust a company to route all their traffic, be their DNS server, not log anything, not be hacked and not give any data to current or future totalitarian governments. Not even I could recommend any VPN company that fulfills enough points there, especially the security related ones.
For the average person, data sales aren’t the worry. Heck their phone is already recording everything. The worry is straight up criminal enterprise, like keylogging bank passwords. If the VPN company is doing stuff like that then they’re going to eat a RICO charge. Most people really don’t care that their data gets sold.
