I used to work for PIA. The best users are the occasional user, and there's a lot of them. They cost little bandwidth, they pop on every now and then and off fairly quickly. Andrew also got pretty lucky, riding both the Bitcoin and Snowden waves. It probably did ultimately run at a loss at some point, but all the big ones could ride on their crypto payments rapidly increasing in value, and the hardcore privacy people were very happy to pay in crypto.

You can easily cram ~1000-5000 active users on a 10 Gbps server because you can assume that most people are far from reaching gigabit on their own (OpenVPN limitations helped a lot there). Even at just a dollar a year per users you've still got 5 grands which more than pays for the server which really only needs a good NIC and a bunch of IPs. But remember, most of those are idle or not connected at all, so you can have many more users than there is bandwidth available. And at that scale you get bulk discounts on the servers as you fill up a good rack or two.

I have to imagine at this point the market is incredibly saturated though, I left a bit over 6 years ago.