Don't get me wrong. I think Mullvad is a great VPN service. But if people think it's a bullet-proof solution to the problem of anonymity, they're fooling themselves.
1. The VPN provider and its infrastructure is trusted.
2. Attackers (private or government) can access data the VPN stores some period of time after you use it, but not while you are using the VPN.
3. Given assumptions (1) and (2) are true, attackers should not be able to determine which websites you visited.
A VPN does nothing if you don't trust the VPN provider (since they can always be lying about keeping logs) or if the government can access the VPN's servers/data while you're using it. But it does protect against one of the most common ways a government/private party could gain access to your browsing history: the government/private party subpoenas the websites you visited or your ISP for all pages visited by a given IP.
In this case, providing an alternate way to pay protects against storing data that an attacker can use to connect your account to your identity.
With single payments they don't need to keep it for so long.