Did you even read the OP? A VPN that has real customers but is set up by a scammer can be doing anything on your computer. You install their client. It could be a key logger for all you know.

And not all services use end to end encryption so yes there is still the potential to listen to http traffic and extract data from it, especially as the VPN client.