.... they're just as likely to be a massive security and privacy risk. The problem is that they concentrate all of the traffic you'd most like to keep secret in one server, and depending on exactly how the system works, may require installing software on your local machine with ~root permissions. If the operator is malicious, this is a really dangerous combination.
So, use non Russian and non US providers.
Because Russia and the US are incapable of compromising or suborning providers from elsewhere?
Use open source clients / systems like OpenVPN.
Use a VM or separate device (raspi etc) to connect to the VPN service.
Install OpenWRT or something similar onto your router (and maintain it), to avoid becoming part of such botnets. Bonus: you can use the router to connect to the VPN service.
Those are all ways to avoid installing questionable software on your primary machine, which is good, but they don't address the fact that you're still routing all of your traffic through someone else's server -- a server that tends to concentrate lots of potentially interesting traffic in one place, making it a much higher priority target than your typical ISP.
If the various intelligence and law enforcement agencies around the world don't own or at least have significant hooks into all of the major VPN service providers, someone should be fired for not doing their job.