have been wondering the same about US based VPNs
Most have servers in data centers in 10+ different countries, so I doubt they are all closely monitored nor capable of keeping their keys closely guarded.
Most VPNs like to advertise the 'military grade encryption' or 'no logs' nonsense, I'd rather see them post results of security audits, ideally conducted by outside firms.
It probably doesn't matter because 99.999% only want to access Netflix in another country. Out of the remaining 0.001%, most are just people from repressive countries dodging their country's porn filters.
If they are giving people the service they want then how is it a scam?
There are loads of trash VPN providers, but there are a lot of genuine ones that really care about privacy activism and provide an honest service.