I just an article today on how brave sells your data to train an AI.
Nothing is perfect. Everything is this world is about trust even if they open source everything is practically impossible for you to verify all the code and then verified if it really been used on the final product . And that is only the VPN , what about the email provider, your ISP , your phone carrier? , the apps you daily use. Are you going to check the source code of every single thing you use? And make sure it is been using correctly? Also even if you can do all that , how do you know the encryption being used hasnt been broken by a government already? Come on man be more realistic.
Holy shit you right. Its convenience I guess for newbies. But yeah thats really bad for privacy.