Can someone with more networking expertise than me explain whether this sort of risk applies only to rented DC servers? Or is it an ISP risk that can also impact Mullvad's owned servers[1]?

[1] Mullvad owns 159 servers in 9 countries (https://mullvad.net/en/servers/), so not quite sure why you wouldn't just choose to use one of those instead if concerned about this