Maybe they could be more forceful about it, but I feel like Mullvad is reasonably responsible about this (certainly more so than most VPN vendors), with their front page describing a VPN as "step 1" and directly saying that "a VPN is not enough for privacy".