I was reading about whether you should trust a VPN any more than your ISP, and I see that some VPN providers claim they do not log users, when they do indeed log users: UFO VPN claims zero-logs policy, leaks 20M user logs.
From my basic understanding of how VPNs work, wouldn't it be trivial for any major state (e.g. US, Russia, China, but not limited to those) to set up a VPN service, and secretly collect the logs?
i.e. if a random VPN provider like UFO VPN can collect user logs for a long time without being discovered, despite having a strict no-logs policy, is that safe to assume that states with strong IT capabilities could easily do the same (i.e. set up a VPN provider and start logging every single user)?