They, and ALL VPN PROVIDERS, sell your DNS data, as well. That's the real business model.
Not all VPN providers sell data (DNS or otherwise). Some operate for privacy-driven reasons and actively seek to be good stewards for their customers.
Their FAQ confirms this, assuming you trust them. https://mullvad.net/en/help/no-logging-data-policy/#no-logs
If a provider can sell a VPN for $1/month as a loss leader and make $5/user after selling all data, what keeps a $10/month VPN from making >$15 doing the exact same thing?
Mullvad is the best privacy-focused VPN, hands down.
That might well be true, but anonymous payments are no proof, or even supporting evidence, for your claim.
It could still be very lucrative to resell data in the form of "users who access foo.com often also access bar.com" – and you can probably see why that could easily be deanonymizing.
Private Internet Access and ProtonVPN both have tenuous relations to shady stuff. Private Internet Access got purchased by the same company that made Cyberghost (malware), but so far nothing bad has come of it. AFAIK they're also the only VPN that has been truly court-tested.
ProtonVPN has some really weird circumstantial stuff related to TesoNet.
Any other VPN I wouldn't trust by default. Shady business sector.
But I don't buy into the idea that anyone can say "ALL VPN PROVIDERS" do a thing.
I believe NordVPN's open sourcing effort here (whether genuine or not) is motivated by pressure from Proton's open source.