It can make such broad claims because it's entirely based on facts. VPN's are a trust-based system where the only evidence they don't keep logs prior to getting a court order is "Trust us bro" and, historically, more of these services have been found to actually be storing records (or legally must store 30/60 days worth depending on their country of origin) than not.

If you would like a more in-depth and thorough explanation as a technical breakdown for non-technical people there is this blog post or even this blog if the "TL;DR" explanation didn't cut it for you.

Regarding profit motives of VPN's - see also:

• https://www.skadligkod.se/vpn/the-trustworthy-of-vpn-review-sites-and-how-affiliate-programs-affects-their-opinion/
• https://restoreprivacy.com/kape-technologies-owns-expressvpn-cyberghost-pia-zenmate-vpn-review-sites/

Here's a real fun one!

This site: https://thatoneprivacysite.net/choosing-the-best-vpn-for-you/ was purchased and now redirects to this site: https://www.safetydetectives.com/best-vpns/

Safety Detectives was purchased by non-other than drum roll please. Kape Technologies. How do I know this? Well let's take a look at the Wayback Machine for TOPS.net.

What was the original claim?

You may have started your search for a VPN by looking for “VPN Reviews” in your search engine of choice. if you had, you would have gotten page upon page of what seem to be harmless review sites, top 10 or blog style reviews of different VPN services. You may even be coming here for confirmation of what you were told on those sites. The sites making these recommendations are, in almost every case, paid by the services they review and recommend.

Who owns PIA, ExpressVPN, and CyberGhost? The "best 3 VPN's" recommended by safetydetectives.com? Kape Technologies.

Why should this concern you?

We'll start with PIA's owner, Kape Technologies. Kape Technologies was formerly known as Crossrider before it was acquired by one Teddy Sagi, an Israeli billionaire that has spent time in jail for insider trading. Crossrider itself never had that great a reputation itself, what with their primary product being a development platform through which they were frequently used by third parties to invade ad platforms to serve up malware, but whatever. Once acquired, the entire leadership structure was hollowed out, and the new Kape Technologies went on an acquisition spree. All of Kape's purchased review sites suggest Kape owned VPN's with "some consideration" given to Nord and Proton to maintain some kind of pretense at neutrality.

In short: Sagi is shady, his business is shady, and his business moves are shady, which makes the whole thing shady from top to bottom. Kape Technologies isn't the only company to go on an acquisition spree for VPN's either. Ask yourself why there is interest in consolidating VPN providers and how that data might be useful.

Every single modern VPN is a honeypot until proven otherwise. Mullvad is one of the few that has been able to prove otherwise.