You're quite right, pools cost a lot of effort and money to be kept online.  So it is indeed a good question, how do they survive.

Let's take a few pools:
- p2pool: this is open source software.  The software is free, but you need to run it yourself.  So not "free", you'll have to host it yourself.  Also, it has a 1% donation to the author "fee", altough it can be disabled, which has to be done explicitly.
- ghash.io.  Owned by cex.io, they use it as a marketing method, they make a lot of money renting hash power.  Hard competition for honest pools...
- eligius: they are driven by donations.

So yes, free pools are to be questioned.  But in general the big pools do it for the money (direct or indirect), the smaller pools do it to support bitcoin (and from donations...)

And yes, you must trust your pool.  Pools can abuse their position very easily.   There have been several cases (bitclockers, bitcoinpool) that are known for cheating on their users, so some have been caught.