VPN providers are an annoyance for "collect it all" types. If they have the ingress servers' wireguard private keys, that annoyance goes away. Note that I use the term "annoyance", not "threat"... they sit in that gray zone where it's an irritant but not worth kidnapping people.