There are some VPN services run on dodgy VPS, but apart from that I'd wager almost everyone either rents or colocates physical servers. A terabyte of outbound traffic is around $170 on AWS but around $5 at a regular data center.
You can get good security arrangements if you colocate in sufficient volume (locked rooms etc). That's where reading security reviews is useful.
protonvpn has its own servers in a former swiss army bunker. these are only a few of the many, but they offer routing to other servers through their swiss center which they market as "secure core".
Do you think the internal auditing and security controls at an independent data center would be more effective than those at AWS or Google?