For how many VPNs is security a barely relevant consideration anyway?
Sure, you want security if your VPN is for connecting to your corporate network and accessing sensitive data. For a large number of VPN users, though, the only consideration is the IP address you appear to be coming from, whether for bypassing geolocation and content blocking, or for anonymity and privacy from those who consider a list of IP addresses a juicy set of targets for threatening letters demanding money.
For these use cases, security of the connection is barely relevant. Certainly far less important than location, speed, cost, and security (or preferably absence of) any logging or customer data.