Which answer accurately captures the risk of using a 'free VPN' app on a mobile device from an unknown developer, as opposed to a corporate or reputable consumer VPN?

• A.A free VPN app from an unknown developer routes all device traffic through the developer's servers, making the developer a potential man-in-the-middle who can inspect, log, and inject content into unencrypted connections (and even encrypted connections if a root CA is installed)
• B.A free VPN app has no capability to encrypt anything, and the tunnel it advertises is a routing trick that hides the destination address alone (the payload leaves the handset in the clear on every hop), leaving a passive observer on the same access point with the whole session in readable form
• C.A free VPN reaches browser traffic and nothing else, and the Android sandbox always prevents one application from capturing another's sockets (the VPN service API is scoped to the declaring package), leaving native app connections on their original path, a limitation the marketing copy rarely mentions to a consumer installing the product