Well, if they can do it without any privileged access to the VPN server (which could be in any other country, so it seems unlikely they could have such access for just any arbitrary VPN) , then they would need to be exploiting weaknesses in the VPN communications protocols (e.g. the recent weaknesses that were demonstrated with some OpenSSL( Open Source Secure Sockets Layer) versions).

If they are using such flaws and keeping them secret, then they are contributing to the overall insecurity of the standards that keep all of our businesses safe and secure and shame on them.

The NSA has been strongly suspected of having done exactly this and in some cases, having gone further by actively participating as expert consultants in standards groups that define security protocols and then using their advanced expertise to introduce subtle flaws into the standards (such as random number generation for elliptic curve algorithms), such that they could subsequently break the implementations of those standards in the field.

This is utterly irresponsible. They are probably not the only people able to break things using the weaknesses they introduced and as a consequence they make the world a less secure place when their job is supposed to be the opposite.

Of course, the other route for subverting VPN use, is to simply subvert the individuals machine first, with things like key loggers and other malware, so that the VPN just becomes irrelevant to the monitoring they want to do.