Mullvad is a nice middle ground for those who don't see that as worth their time or don't know how. Its good to see they're at the very least trying to keep up appearances.
I don't really see how it's more secure to run some software that you haven't audited on a VPS somewhere at a provider you haven't audited. I'd trust a company with resources to run their own hardware, investing into a more secure setup [1] and contributing to more open infrastructure [2] much more than I trust myself to run something securely which isn't my sole occupation.
[1] https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur...
[2] https://mullvad.net/en/blog/2019/8/7/open-source-firmware-fu...
1. |Router| -> Wireguard / OpenVPN -> |VPS|
2. |Device| -> Wifi -> |Router|
3. |Device| -> app -> |Mullvad|
= |Device| -> |VPS| -> |Mullvad| -> Internet
Can do various mixing and matching if you have more than one VPS. Again, it rearranges rather than removing the vulnerabilities, and it's pure window dressing against an organised, financed actor.
I've done this as an intellectual challenge more than anything else.