> However, the worst case situation is that they lie about not tracking users and then they get hit with a LEO request they bow down to.

That's within reason though. A VPN is another ISP afterall, so they have to 'bow down' to law enforcement requests. What LEAs can get depends on how zero knowledge the VPN setup is. OVPN[0] for example has been 'court tested' and Mullvad had nothing to give to authorities[1] since they don't collect it in the first place (apart from payment metadata).

I'm not affiliated with OVPN or Mullvad, just a happy paying customer.

[0] https://www.ovpn.com/en/blog/ovpn-wins-court-order

[1] https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subjec...