Actually we have more than enough leaks and hacks throughout the years to know that this is not paranoia but basically routine. Companies that say they encrypt everything? Everything in plain text. Companies that say they delete everything? Everything is saved. Companies that say they do not sell your data? Everything is sold. Companies that say they keep no VPN logs? Everything is logged.
There is just another VPN company exposed this week -- the logs, together with other data, could possibly even identify the individual users. Of course, not every company lies about everything, but you don't know which one is lying. And there are also unintentional mistakes. Apple does not e2e encrypt a lot of things, and could be social engineered into offering data, and as reported on this site, may have done so to fake cops. True e2e would have made this impossible.
I am not even paranoid about it. Kind of desensitized to be honest.