NOT IN Subquery With NULLs

A CTE-based NOT IN filter silently returns zero rows because of NULL handling in the subquery.

WITH churned AS (
  SELECT customer_id
  FROM subscriptions
  WHERE status = 'cancelled'
)
SELECT c.id, c.name
FROM customers c
WHERE c.id NOT IN (SELECT customer_id FROM churned);

The query is meant to return all customers who never cancelled, but it sometimes returns an empty result set. What is the bug?