Fundamentally, a VPN is just tunneling your Internet traffic through someone else's computer. That gives an unscrupulous VPN operator a whole lot of opportunities -- spy on your traffic, inject ads or malware, etc.

Reputable VPN providers wouldn't do this, of course, because they'd be dragged over the coals and go out of business when it was discovered. But if someone's not charging for a VPN service, I'd question what their motives are. It's possible they're just a privacy advocate with pure motives, but it could also be a lot more sinister.