The threat model for "I want to watch Netflix in a different country than the one I'm in" is totally different from "I'm Edward Snowden and the CIA wants my ass". Consumer-grade VPNs protect against the first "threat" alright, but it's a totally different ball game to protect against an APT like the NSA/CIA, who will break into your VPN company's office in the middle of the night and replace all of the computer keyboards with exact replicas that have a keyloggers inside in order to get access to your data.