If you want something European, I'd throw AirVPN in the mix. I went there and never to Mullvad. And now I'm glad I didn't and at the same time I'm looking forward to hearing inevitably what corpses my current provider has in the cupboard.
I dislike Proton, which I quit after the CEO praised 47 on his big tech regulation and before they handed the email account of some environmental activist over to the authorities, in France IIRC. They want to be your replacement for Google and keep pushing more services at obscure subscription levels at you. In terms of VPN, they were good though.
Your first question is answered by the article you linked. And therefore the answers to the two-part second question are no and no.
"Rogue" is a questionable choice of vocabulary. It went rogue when compared to the intentions and expectations of the testers. It didn't do Mr. Burns hands and released the hounds on a whim. It was told to do a thing and did the thing in a way the researchers thought it wasn't possible. It boils down to human error in how this test was set up. It's worrying that the researchers underestimated the agent's abilities or overestimated their ability to properly contain the agent. But the sky isn't falling just yet.
A positive side aspect is that they didn't try brush this under the carpet.