This would require the server's certificate, which the VPN wouldn't (generally) have access to.

The key part of this is that server certificates are trusted and verifiable. To the extent that's true, the process is secure against man-in-the-middle attacks. That's because the client browser can confirm that the server's certificate is legitimate, and encrypt its own public key with that server's public key, so nobody in the middle can read it.

If a man in the middle replaced the encryption keys with their own, then the client would know about it, because it can verify the server's encryption key and of course it knows its own private key, which has never been transmitted over the wire.

You can read more details on the process here: https://www.ssl.com/article/ssl-tls-handshake-ensuring-secure-online-interactions/

Of course nothing is 100% secure. God only knows how many third parties (like government intelligence agencies) have compromised major certificate authorities. If you have access a certificate authority's private keys, then you can spoof basically anything.