> And how much "surveillance" does a VPN prevent anyway?
Changing your acc number every other month and paying anonymously is much easier on Mullvad than on the ISP level. You can also get multiple people on the number very easily. And Mullvad is likely an entity outside of your home country, hence more difficult to coerce than your ISP.
In my eyes ISPs are compromised by default so the aim is to guard against them, if Mullvad is also as compromised it's more difficult for them to track me across account numbers and, even if they do, my data is then in another country, which worries me less than it being local since I'm not important enough to warrant international action.
> And Mullvad is likely an entity outside of your home country, hence more difficult to coerce than your ISP
This is not true in the EU or for the signatories of the Lugano Convention (the EU, Switzerland, Iceland, and Norway). Mullvad is very explicit that they'll abide by all EU laws. For instance, see the e-Evidence Regulation specifically written for "network-based services" like "proxy services": https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...
> Mullvad is also as compromised it's more difficult for them to track me across account numbers
That's your assumption, not an assertion Mullvad makes?
> even if they do, my data is then in another country, which worries me less than it being local
There exists international treaties on intel sharing (including for "cyber") at every level: The UN, The European Council, the EU, the NATO states, and so on.
> I'm not important enough to warrant international action
Your government can demand action of other governments and businesses via various treaties it may have in place. Mullvad, since it says it'll abide by all EU / Swedish laws, is not a hurdle for your local LEA you think it might be.