You are the dumbest developer in the current space. Just because you can't self host and rely too much on provider's subscription, doesn't mean others follow the same.
Local self hosted models are the future and no one can take that away from you. Get that through your little brain.
Mullvad has proved it doesn't collect. It's laughable to even suggest it.
They have been raided multiple times, tons of audits, does bleeding edge research on privacy preserving tech, donates to GOS, etc etc. You don't see this kind of VPN company at all because none exists.
GrapheneOS already does this, since forever. Android can't stop copying GOS. Maybe they'll add a network toggle after a few years and call it a privacy win.
Dangerous how? Create a CAA record which pins your CA and only allow dns01 challenge. Problem solved, a BGP hijack can't issue a valid certificate for your site.