That's kind of my thought as well. It's certainly possible someone might go through the effort to find a single pirate downloading The Lion King, but that's a lot of effort (read: money) to find just one person.

There's certainly the possibility that an ISP could note that you connected to a VPN, but given that it's not a remarkable event, since people connect to VPNs for all kinds of legal reasons, they aren't likely to track your particular IP's connection to a VPN apart from a court ordering them to care. They get paid their monthly internet plan price whether someone pirates or checks their email.

If someone was running the Pirate Bay from their home servers, however, more parties would likely be interested in finding that person, and that person's threat model probably exceeds just using a logless VPN.

At least that's a more reasonable answer than trying to imply the NSA has backdoors everywhere.

My position is that it all depends on your threat model. The government isn't likely to go after someone who torrents files and is hidden by a VPN. The government might go after someone running a streaming site, on the other hand.

And even that might wind up with a dead end. AirVPN (for example) is Canada-based, has no logs, and accepts both crypto and anonymous cash payments.