OPSEC is hard. Even people for whom it's a matter of life and death fail at it routinely. Angry trolls even more so. Your first message may be anonymous, but by your third message there's a good chance someone dedicated could find you if they cared enough.
In case of angry trolls, that's usually quite a long time.
Money
>Why would you assume that the majority of VPN providers lie to customers?
Money. There's no way to confirm their claims, and if logging+selling data= more money, there's a reasonable assumption that is indeed the case.
>Why do you think people who want to stay anonymous don't know how to throw off browser fingerprinting?
Even if they do, it's difficult, ever changing, and easy to slip up.
Those underlying ISPs have data that can be used to correlate (with a scary amount of accuracy in a remarkably short space of time) your flow to the VPN server against a flow from the VPN server to a remote host.
Without exaggerating, lives have been saved through this technique. Once the technology exists for one purpose, it can be repurposed very easily.
There are literally businesses out there that gives you a snippet to embed in your site, and then they employ all the tricks of tracking to give you email, name, address, etc.
It's not perfect every time, but probably more that you would like. And I wouldn't be surprised if incognito mode or VPN isn't always enough to disappear.