I have had this same thought.
MullVad is based in Sweden which probably has some of the best "privacy laws" in the world so I don't think it will happen anytime soon but always a possibility.
MullVad does not collect any personal information to create an account. It generates a 16 digit number which can be used and thrown away at any time. They accept bitcoin as payment and generate a new address for every payment.
From an account perspective, that meets all of the necessary requirements to maximize user privacy. No names, no email addresses, no credit cards necessary, no address reuse.
They're doing things right but it can always be a honeypot so don't do illegal stuff with their VPN.