i don't care about their VPN. the issue you describe is very real, but it's inherit to all vpn providers. what i care right now, is their email service. you can switch vpn providers in less than 15 minutes, but email takes days. so i wouldn't want to go around doing all of that every time some employee says something stupid.
and btw, if you use native installed apps, then the worry of them serving malicious javascript goes way down because any change they make on the complied package would be very likely to be very obvios to someone, because its open source ( i won't go into detail here).