I mean, it is technically possible, that a VPN company could be doing absolutely anything, really. They could be harvesting data, storing it, selling - doing whatever with it. I honestly think it's quite unlikely though.
The main reason is cost and risk vs reward. Storing all of that data, sifting through it to find things worth selling to other companies, is not a trivial or cheap thing to do - that's withstanding the fact that the vast majority of internet traffic is encrypted anyway, because a huge amount of it is SSL, especially stuff with anything personal inside it. Even if they did store it, or provided backdoors to others - the vast majority of it would be unreadable. It would also most likely come out if they did it / tried to do it, somebody would find out - or leak it, then the VPN company would be finished.
I also find it highly unlikely that an established VPN company would talk to the government and/or create any backdoors. Very few people (including governments) have any idea what they're really doing when it comes to dealing with raw data like that, outside of big tech companies like Facebook/Google, etc.
I do think the protection VPNs offer is somewhat overblown, ISPs don't generally log actual customer traffic (nobody does that because it's practically impossible to do) they simply keep a record of your account number, source/destination IP address of the data flow, and that's about it. A VPN will obfuscate all of that, but unless you were surfing on sites which had actual illegal content on (like child porn), there wouldn't be much else in the record that could be used. If a judge granted the police a warrant to instruct the ISP to perform "lawful intercept" on your traffic - chances are, you're up to something very bad anyway, you don't get that by accident
