That’s not how these things work - Intelligence agencies use cover companies very differently. They simply provide a few people money to create a company. These people set up a VPN company - and run it like it’s legitimate.

Marketing or legal won’t know that their company is actually a listening post, most Datacenter employees won’t know, only very few people(mostly network engineers and IT security, some managers)would know. And of course the Auditors - which is not a hassle for any decent intelligence agency.

It’s far easier than one would think - how do we know that? Because it would be the same way other intelligence service companies are run like that for decades.