... they're often lying. In particular, servers in exotic locations are almost always the result of "creative" routing, and are physically located in a more standard country.
Due to IPv4 shortage, we're actually seeing a lot of chinese and european companies buying IP addresses in AFRINIC space, from african ISPs, and using them in their own countries.
If your threat model is such that you're concerned about TLAs or state-level actors targeting you, you're already in a world of hurt.
If you are under the mistaken belief that the VPN provider is anywhere near as conscious of your security as you are, you're already living a bit of a fantasy.
So the answer to your question is that it's not really possible to think that they're ultra-secure, but that ultra-security was never what they were selling.
A big part of security is your relationship with the people providing you hosting.
The compromises to nordvpn and others came from a rogue hosting company, for instance.