The operators of the VPN in this case are also the developers of the browser. If they want to inject content they can do that without the VPN.