I think some of the free VPN services may hardcode/import a configuration so your settings areessentially baked in. Your only option is to start and stop the VPN, and maybe change the server location.
In that case you're already running code from them so what's the difference if the "exploit" is in the script or the app.