And yet you are happy to pronounce on other companies that you also don't know anything about.
I'm simply pointing out that (many) shady examples exist and that I think it is foolish to trust any such company by default, which is what you seem to be suggesting by saying 'name the bad ones'. You should be suspicious by default of some random company on the Internet that sells VPN services. At least your local ISP will be a known quantity; they are subject to the same data protection rights you have with any other company you do business with in your country (or possibly more, in some places where common-carrier communications have special protections), they're probably subject to some scrutiny about such matters, you have a legal agreement with them that presumably comes with some legal rights, and you likely have some practical legal recourse if they violate it.
You seem to be missing the point here. When you use one of these services, you are choosing to shovel all kinds of personal data to them willingly. If you care about privacy, you should probably think about what that company might do or want to do with access to that data. You may conclude the answer is 'less than my ISP' or 'less than my government', and that's great, just don't think that shipping your data securely to someone else is automatically going to improve your privacy or security posture, all it does is change who you are trusting with it.
Perhaps you could share the names of the companies you do know about?
The highest profile scandal is probably around Kape Technologies (owners of ExpressVPN, PIA and others, including VPN 'review' sites). See plenty of reporting on them, but basically this company has connections to the UAE intelligence apparatus, previously was heavily invested in developing browser-based private data collection software and spyware, and the owner himself has a pretty shady past. For example
https://gizmodo.com/you-should-probably-stop-using-expressvpn-1847739547SuperVPN (and related companies) has a pretty serious compromise. NordVPN leaked some key back in the day that would've allowed an adversary to spin up a server impersonating them.
Folks need to decide for themselves whether they trust or don't trust these companies, based on their own situation and needs.