One may often hear the expression "if you're not paying, then you're the product" for websites, but in the case of "free VPN" (or maybe even very low cost ones), it's my understanding that's how they're free to the user: because they're paid by folks who want residential IP egress

I'd guess any such VPN can even put in their ToS "you grant $company the ability to send and receive traffic from your device" which wouldn't raise eyebrows in the same way such a clause in an image viewing binary would