Apple Users

Yes, the bad guys could be anywhere. But the people running a VPN service are in a unique position to (more) easily steal lots of comms.

Basically think the hacker next to you in the coffee shop can peek at your unencrypted DNS queries (so they see what sites you're using), but your encrypted (https) traffic won't be decodable. Of course if you use HTTP then that traffic is unencrypted and visible too.

But the state spying agency that's compromised a VPN service can vacuum up all the traffic you send it, and could likely get around the https encryption as well.

Basically use VPN to avoid the WiFi traffic sniffer in the coffee shop, but I wouldn't trust them if you're a Chinese dissident trying to avoid arrest.