I would definitely blame a VPN provider if: 1. Only a minority of users care about privacy 2. VPN provider still advertise for “privacy”, even though it only target a minority of users that care about it 3. VPN provider doesn’t deliver on said privacy.

I blame mullvad for messing up, but I do not suspect them of working with some state sponsored surveillance programme at the moment.