Big Mama VPN has been turning its free VPN users into a proxied peer to peer network that would bypass any kind of security your own router provides. It appears to be selling your own local net (Zone Transfer) map to commercial customers and allowing a peer to peer network to operate on the end users IP address.
Aside from “well just don’t use them sort of thinking” which won’t solve anything; What I hope this does is open up the can of worms behind what free or even low cost security solution providers are doing with your data, IP Address and devices inside your own network. It’s a discussion worth having. This is going to be an ongoing concern going forward because this is a potential pathway for state actors to get inside private networks and do nefarious things.
Nord VPN is a constant presence on YT in terms of advertising, but they have been caught not only logging the activities of its users but providing or leaking that data to third parties (not limited to just law enforcement). They publicly advertise they do not do this.
My own preferred secure email provider (which is by no means cheap) also admits to structuring its log-in page to (redpill) allow a backdoor into your webmail account and sessions via a specially coded log-in (code injection) button which they swear is only there if they get subpoenaed by law enforcement (or maybe a third party?).
Avoiding free VPN’s or free security security services providers is not going to solve this or make it go away.