Phoenix can be downloaded from their github page directly. It is still viable in the US even without a VPN. My theory is that they said what they did to comply with US laws, but it is still a non-custodial wallet, you still own your own keys, so outside of closing channels (which they didn't do to any of their US base), they can't really rug you. Worst case scenario, the channel close moves your btc on chain. I used them up to yesterday when I started my going phoneless process. Solid wallet.