Researchers tested 281 free Android VPN apps and found unencrypted transmissions, traffic leaks and widespread tracking inside tools supposedly designed to protect users’ privacy.