If the objective of using a VPN is to dodge GCHQ or NSA, then that person is likely not properly accounting for the capability of those organizations. I imagine those two have the ability to tap just about any traffic irrespective of the parent organization's infrastructure. Would Mullvad be wise to consider this in their expansion efforts? Sure, but I have to assume that the vast majority of their market is not in the habit of getting on the NSA's target list. I use Mullvad because they have sound business practices, good performance, and don't conduct the same invasive privacy practices that I'm trying to stymie across the web.