Implying that PG should remove Mullvad, arguably the most privacy-respecting VPN provider that is constantly innovating in the VPN space, is completely insane when Mullvad has specifically stated in multiple instances in here, here, and here, that this specific law does not affect them. The fact that you do not trust Mullvad’s word is your personal issue and shouldn’t affect the recommendations of PG.
It is also interesting how you initially wish that we ask Mullvad to clarify the situation, and when more sources are given to you that directly tell that the law doesn’t apply in their case, you start questioning Mullvad’s trustworthiness, and demand an opinion from a 3rd party. Yet, your linked 3rd party sources do not say anything about VPN providers specifically that appear to be the key when trying to understand if the law affects Mullvad or not.
However, since Mullvad has stated that the law does not affect them, I have no reason to doubt that considering their spotless track record and strong reputation in the privacy community. I also believe that they are more knowledgeable about this specific law than you are, which is why I think it is a bit odd that you’re pushing this narrative without any kind of real prove that would demonstrate anything to the contrary.