Maybe not hard to build, but they are decidedly non-trivial to maintain. Their whole purpose is to get around the business/political decisions of one organization or another, and those organizations are making it increasingly difficult to be got around. A "real" VPN company has to deal with service providers on both ends of the tunnel trying to detect and block them, compliance with complicated legal situations in every country (and state) they have a presence in, law enforcement demanding access to logs and traffic, fraudsters trying to create accounts with stolen payment methods, attackers trying to make their way into the system for a variety of nefarious reasons, and semi-regular zero-day vulnerabilities being discovered and patched throughout the whole service stack. To name just a few of the most obvious hurdles.

No, I would not want to be responsible for running a VPN service in this day and age.

Email hosting is not much better, for most of the same reasons as above, except that spam filtering is also a whole full-time profession unto itself as well.

But yes, I agree with your point on Mozilla's lack of focus. And management competency, I would argue.