> If no, then an audit has little to no value as it still implies trusting the vendor not to fudge the binaries or, more broadly, be malicious.

Given they provide a VPN service, trusting the binaries is only going to take you so far.