Shady VPNs are giving people a ‘false sense of security.’ But why are Russians being targeted?