From cybercrime to cyber defence: How VPNs went mainstream