At worst, they route your traffic through a malicious proxy server owned by the cracker, allowing them to inject ads, steal data, or even commit fraud using your IP address.
ExpressVPN is a server-side service. Unlike a photo editing app that lives entirely on your hard drive, a VPN requires a handshake with a remote server to function. Since ExpressVPN’s servers require a valid, active subscription token to allow a connection, a "cracked" app will usually fail to connect or will simply be a reskinned version of a dangerous, slow, third-party proxy. How to Get ExpressVPN Safely (The Legitimate Way)