Broadly speaking, using a VPN does not eliminate all risk, it is about shifting the risk (perceived or real) from your ISP to the VPN.
People have different reasons for using a VPN like:
- evading government surveillance
- becoming more 'anonymous'
- accessing geographically restricted content (streaming, movies)
- protecting themselves against rogue access points when on the move
Depending on what you are trying to achieve a VPN can be a solution... or not.
The worst risk imo is that the VPN will often turn out to be useless and will not help you achieve your goals. I am not going to cover all possible scenarios but suffice it to say configuration errors are very common, at least client-side like:
- leaking DNS requests
- leaking IPv6 traffic
Or:
If you are looking to 'cloak' your traffic from the authorities then the plan is not being fruitful. And most people don't have the technical skills to thoroughly assess their VPN setup.
It's recommended to research and find a trustworthy VPN service, if
needed. What could happen, if the service provider acts against their
users? (Because of malicious intent or a security breach)
We should first define the meaning of 'trustworthy', because everyone probably has different expectations. Some people must think that a trustworthy VPN service is on that will never cooperate with authorities, even if you engage in highly illegal activity. The second aspect is how do we assess trustworthiness. I would guess: based on their track record, except that you won't hear so often about people indicted thanks to cooperation from their VPN service (but it happens).
You usually don't know the people running the VPN service so why would you blindly trust strangers with your Internet traffic ? Providers of VPN service talk a lot about privacy and make often misleading claims about 'not logging traffic', but there is no way to verify those claims.
If you are paranoid you can set up your own VPN service, cheaply. All it takes is a decent VPS. But that does not solve the confidentiality problem completely. The webhost could be monitoring (or logging) your activity. At least you have full control and you can configure it the way you want. But you become less anonymous too (because your Internet activity is tied to a static IP address). Again, it depends on your goals.
Can the VPN connection potentially work both ways, as in: The provider gaining access to home networks? (When using OpenVPN or proprietary client software)
This is an interesting question. A VPN is a network tunnel so it works both ways. The provider has to segregate traffic and isolate the activity of clients. As for yourself, you should have a firewall on your computer. The other end of the tunnel can probe your computer. If the VPN is misconfigured (lack of isolation) it is conceivable that others on the same network segment could also probe you.
There are some other risks, that are not technical but practical. Many websites block VPN outright or flag their users as potentially high-risk clients (they assume you have something to hide). If you order some stuff you may be subject to increased scrutiny because of your IP address. Your credit card payment could fail become you appear to come from another country. At times you will be asked to justify yourself.
Keep in mind that the IP address ranges of popular services are usually well-known - lists exist. Since you are sharing IP addresses with other people you can also be affected by the bad actions of other people. Imagine that you are ordering stuff from some site, and another person defrauded them, using the same VPN, possibly the very same IP address. What the vendor thinks: you are the scammer and you're trying to pull another scam. You: trying to prove your innocence.
Worse, if you had an existing account in good standing it could be jeopardized/tainted because of that fateful connection made using a third-party VPN service.
In 2020 algorithms make decisions, risk assessment is computer-driven and humans are not always in the loop to endorse decisions. There is no such thing as automated justice. On the other hand automated discrimination does scale pretty well.
