It's not shady, it's just a business model. The goal of the lead developers has always been to turn iodéOS into a self-sustaining project that they can afford to work full time on. That's why their headline feature, the iodé app, was partially closed source during its core development phase. Once they got it to a stage where it could be monetised, it went fully open source. At the same time, they notified all existing users on their forums and through the iodé News app of this change and offered a free lifetime premium subscription to everyone. There was no bait-and-switch, they looked after their community and were always honest about where the project was heading. The block lists locked behind the paywall are non-essential ones targeted more at parents - stuff like social media and porn. From a privacy standpoint, there is little difference between the free block list and the premium block list. I have devices running both and I notice zero difference in what's being let through. This is particularly true if you're using FOSS apps with zero tracking, which you realistically should be trying to do if you care about your privacy. Even in the unlikely scenario that there is some really pervasive tracker that gets through the free block list, you can just use a free service like NextDNS to block it.

As for security updates, it's true that iodéOS is slower than alternatives like DivestOS, GrapheneOS or CalyxOS. iodéOS's schedule is similar to LineageOS and /e/OS (also based on LineageOS), and usually runs about a month behind the aforementioned three. That is still a lot better than most stock manufacturer updates, by the way. However, I think whether this is an issue for you just depends on your personal circumstances. I don't see all six of these projects in direct competition with each other, but rather covering different areas. If you have a newer Pixel, then for sure DivestOS, GrapheneOS or CalyxOS make more sense but LineageOS, iodéOS and /e/OS all support a wider range of older devices that aren't supported anywhere else. If you're using, or want to use, one of those devices then it's no longer a question of update speed but rather whether you get updates at all. The reason why I started using iodéOS originally wasn't because it was outright better than GrapheneOS or CalyxOS, but because it supported my existing phone.