You are certainly right but what they could do with this, if you are not a dangerous terrorist? I don't think those datas can be used as evidences in court. Moreover most of illicit activities are only done on the darknet nowadays.
All information they collect can be used against you, and you don't have to some criminal or evil terrorist.
I am just saying that nobody should think using VPN is perfect protection and that you can do anything you want on internet.
Back to Mullvad VPN, I just saw they created Tillitis Key hardware company, for logging in to computers and using digital signatures.
Good thing that both hardware and software are open source and code can be found on their github page:
https://www.tillitis.se/https://github.com/tillitis/