Also they actually make it easy to use their services without providing any data - you can use them by paying Monero over tor, and the only thing identifying you is a short unique "identifying number" - no emails, no names, not even an account.
Even if a three-letter agency intercepted your package and swapped your gift card with a known code, I believe Mullvad is not recording the connection between specific gift code and the account number.
You can also exchange unscratched gift cards with friends and strangers.