This saying is actually horseshit, though. The profit motive and infinite growth model of capitalism guarantees that even if you are paying for a product, your data and attention — everything that can be — will be monetized eventually.
The saying should be "if the service isn't open-source and E2E encrypted, you're the product"