There’s a famous hacker guy who setup a free VPN and he used it to monitor the people who were using the VPN, including some scammers that were using it.

So, worst thing that can happen if someone gets to see everything you do online.

Being use in malicious botnet.

You’re an open book for whomever is operating that VPN. If you’re using a service that’s free, you’re the product. Just go with a privacy oriented VPN, they’re worth the money.

You give a list of all the servers you connect to to the owner of the VPN rather than your isp

The VPN could record all your usage and then, at some later date, the owners could make the records public. Then whatever you did over the VPN would be known to hundreds of law enforcement agencies and thousands of corporations around the world, plus all your older relatives. This may not matter much if all you’re doing is trying to keep your mom from knowing you occasionally stream raunchy anime. If you’re a Russian dissident, it may matter a lot.

Depends on how you’re using the VPN. If it’s just a browser extension, then they can see and mess with your browser data.

If it’s a phone VPN profile, they mey be able to access and control your phone.