Well, it depends who you use, which is why ideally you pick one run by people who ideologically support the right to privacy, and based in a country with good privacy protections, but it is definitely theoretically possible, but IMO all you really need to do is the same diligence you would with a direct ISP connection - make sure sensitive info isn’t transmitted in plaintext, etc.