Yeah obviously, do you think that's evidence that every single one is a honeypot?

No. You don't need to compromise every single VPN, just enough that the investment makes sense.