What is the risk of using a 'free VPN' app on a mobile device from an unknown developer, as opposed to a corporate or reputable consumer VPN?

• A.A. Free VPN apps are technically incapable of encrypting traffic; they only obfuscate the user's IP address
• B.D. Free VPN apps only work for browser traffic and cannot intercept traffic from other apps due to Android's sandboxing
• C.C. Free VPN apps use weaker RC4 encryption instead of AES, making the traffic easily decryptable by the developer
• D.B. A free VPN app from an unknown developer routes all device traffic through the developer's servers, making the developer a potential man-in-the-middle who can inspect, log, and inject content into unencrypted connections (and even encrypted connections if a root CA is installed)