Over 90% of free VPNs are a direct threat to users.
The threats include sale of your data to data brokers and often incorporate adware (this is how the free VPN providers make money), and more seriously, the installer or the software can be a vector for malware, including stealers and ransomware.
This is not just theoretical - read this report on Forbes https://www.forbes.com/sites/daveywinder/2025/01/08/google-security-alert-as-backdoor-vpn-threat-confirmed/ on the playfulghost malware as reported by Google at https://www.googlecloudcommunity.com/gc/Community-Blog/Finding-Malware-Unveiling-PLAYFULGHOST-with-Google-Security/ba-p/850676

Another risk is from SEO poisoning and phishing attacks (described in the Google/Mandiant article), where cloned sites from the likes of protonVPN and NordVPN lure users into installing and using trojaned copies of commercial VPN software discussed here: https://www.tomsguide.com/news/fake-protonvpn-malware

Remember- if you're not paying for the product, you ARE the product.