Risk could be deferred to the VPN provider; the VPN provider of course has to be trusted. In terms of security, while a smartphone sharing its hotspot is very convenient it has a lot of software which can increase the attack surface. If the user is paying for internet access, there could be a USB-powered cellular router (which the driver could plug into one of their in-car sockets) with a separate sim card with the VPN at the router level. Billing might be complicated, however, if it's not a one-time flat rate (i.e. they get in the taxi and are charged a flat fee for wifi.)