

Not OP, but for me the issue is if you want to override the default and make it opt-out, especially sine the opt-out process isn’t that well documented, then you should realize that support is a necessary part of that process and fix problems as they arise rather than resorting to name calling and hostile behavior when something you published is broken. It’s a responsibility of taking on that kind of project. Either that or make it explicitly opt-in and give users a warning like with beta version opt-in notifications that the packages are not official and issues may not be fixed as quickly as the official releases.
Can’t speak to this incident, but i do agree that in general, free VPNs are not safe because usually they are funded by selling your personal information and web traffic data or performing MITM attacks to inject ads and thus compromising security, even if that’s not the intention.
That being said, Rise Up is a donation funded organization and is specifically run by a nonprofit promoting activism, so really it all comes down to your trust that org. The cost of bandwidth required to run a VPN is high, their site mentions it costs them about $60/person/year. So that money has to come from somewhere. If you’re paying, and it’s a reasonably trustworthy company, then it’s unlikely they will be willing to risk selling your data. But if you’re not paying, then the incentive to not sell your data just isn’t there, thus it requires more trust, IMHO.
Also, if they are a legit org and I take their product without paying, I’m taking that money from activists in places that truly need VPNs to stay safe from arrest or murder, so I generally don’t feel it’s moral to use it just to save money, but that’s me.