I agree with your point on the costs of free services. I'm happy to pay myself. In some parts of the world, it's very tough to transfer money to a circumvention or anonymizing service without getting in trouble.

But if a user is both unable to assess the security of the system them self, and unwilling to trust another's analysis, the funding model is irrelevant. Source is the gold standard, IMHO, even if that's still not terribly helpful.