If you know you're in honey then you act accordingly. If you think you aren't in honey then you're more likely to let your guard down and get into trouble.
For instance, an embassy with clear telephone and telegraph lines knows they're being listened to, and subsequently is very careful about what they transmit. An embassy who has bought Crypto AG (https://en.wikipedia.org/wiki/Crypto_AG ) equipment thinks they are secure and transmits information they would never dream of sending if they knew they were being listened to.
Sure, but that's orders of magnitude more effort, oversight, manpower and political risk involved than your typical "find a thousand people who have a paper trail saying they did X, pick the five hundred of those who you have an airtight case against, pick the hundred of those who juries will find least sympathetic, pick the 50 of those least likely to shoot back" type" operation that the fedcop enforcement agencies run fairly unilaterally every single day.
Basically, yeah. Unless it's your server in your basement and/or colo, you have no way of knowing for sure. Plus reselling that data could be very lucrative, as there are a lot of companies (and governments) that would be quite interested in that data...
Specifically:
* there is a presumption that a VPN, esp. a commercial one used by the average person for non-work related activities, is doing something shady. not entirely unfounded, though "shady" could simply be watching Brazilian Netflix
* the ISP can't see what you're doing, but the VPN can, and they're almost certainly using some sort of specialty firewalls / VPN aggregators / custom devices. Chances are those devices can do some deep packet inspection, and any lag would be perceived as using the VPN. Might even be able to MITM connections, maybe.
* DNS is often just as interesting or damning as actual traffic, and most VPNs will configure you to use their DNS to prevent leaks. but that means they know you're looking up "totally-legit-bitcoin-trade-site.com", or maybe "hardcore-gay-pronz.net" 3 times a day. they don't know what you're looking at while on those websites -- maybe you're ssh-ing to their server to fix apache? -- but they can make assumptions.