Everything a malicious Tor exit node can do, your VPN provider can do too.
Additionally, malicious Tor exit nodes cannot see your home IP address, but your VPN provider sure can!
Furthermore, exit nodes only see your traffic for a fraction of the time you're using Tor, and has other people's traffic mixed in with it. But your VPN provider has dedicated access to all your traffic for as long as you're connected.
So not only can they do all the Bad Things that people claim Tor exit nodes are doing, they have even more options for harming your privacy than a three-letter agency operating a few Tor exit nodes could ever hope for.