these are valid questions to ask but I'd be wary of falling into this very common trap that I see on HN, which is dismissing the sophistication of a product based on, well, nothing really. Given that another company was willing to pay $1b, and given that this is a free market, do you think it's more likely that ExpressVPN was simple and "not special", or that there is actually some substance there?
Let's presume you are correct; is they idea that they are then special in a way that PIA isn't? This is just like when your local supermarket gets purchased by a company that owns other nearby supermarkets to be folded into their brand: they want the location and the customers that visit it, not some interesting innovation they heard you have been hiding for how to run your supply chain.
It’s a bit like saying “but getting to the moon is just a bit of metal and fuel”.
Execution is everything. And there are no guarantees when it comes to execution. That’s what the cost of acquiring an otherwise “simple” business is: the cost to guarantee successful execution of a business/product plan.
You're suggesting that either ExpressVPN was a really good business with sophisticated secret sauce, strong technical chops, and capital assets probably worth $1B (validated by people with lots of money being willing to pay for it), or that I and other HN commenters are wrong about the sophistication and it's really worth peanuts because OpenVPN can be run on most routers or any Linux box.
The latter is obviously false, but the former is not necessarily true - instead, what I and other users are pointing out is that they're really selling is their users, and implying that the buyer expects to be able to extract more than $1,000,000,000.00 of value from them. As you pointed out, you see this sort of comment when a social network or many other kinds of startups with lots of users are sold.
The point is that the users are the product in this transaction.