If someone is determined enough, they just subpoena the VPN and ask for logs. Since a VPN is a single-hop proxy, your real IP is trivially exposed. Even if the VPN provider claims they don't keep logs. There's no way of proving they don't keep logs, and you need to hope the server you connect to is not compromised in some way. And VPN providers are known to use cheap colocation servers/Virtual Private Servers which have questionable security.