"Show don't tell" is a great rule, but a horrible law.
... because absolutes are always wrong.
The problem manifests here, I believe, in an overapplication of the rule. There is information about the world that the PCs know but that the players don't. For instance: in just about every campaign I've ever run, it's hard to find a member of a traditional PC race (humans, elves, etc.) who can't recognize the holy symbol of the campaign world's major deities and give a 2-sentence description of them ("Pelor is the god of the sun. He supports those fighting evil. His holy symbol is the sun."); it's about 50/50, IME, whether a given player will know even that much about about one of the core deities (especially if you pick a core deity to whom the player's character isn't a cleric or paladin).
Similarly: in the real world, "everybody knows" that vampires are evil bloodsuckers who can't come into your home without an invitation and are repelled by garlic and the cross. That's simply information that "everybody" has picked up by the time they're an adult (though, see this XCKD about exactly when someone learns something that "everybody knows"; tl,dr: with a few assumptions, there are 10,000 people per day who learn something that "everybody knows" - be excited that you get to be the one to show them the thing!).
My vampires don't sparkle.
Which brings us to the problem. If vampires in your world are always evil, that's something that the characters might reasonably know (especially if they're trained in religion). Hiding the information could mean that the decision to become trained in religion was wasted, since the information that should be revealed by that training is hidden by GM fiat - much the same as if the (usually) rogue, trained in stealth, gets seen by the guards simply because the GM needed the rogue to be seen.
There's an argument to be made that vampires might be particularly rare in your world, but even in the real world - notably devoid of vampires - we all know that vampires are always evil (unless they're not; warning: TVTropes).
In my 20 years of playing and GMing, I've never seen good results come from hiding information that the characters should trivially have from the players, but I have seen several players become quite frustrated when their investment in knowledge skills has been ignored by the needs of the plot.
I will freely grant that there's a fine line between gating information by fiat and setting a reasonable DC that just happens to be high due to perfectly reasonable in-game reasons (or perfectly reasonable out-of-game reasons: I recently introduced a dragon as a mini-boss; the party wasn't able to get any but the most basic information about that particular dragon - green and highly loyal to an atypical deity - simply because I didn't know any of it).
But: I never hid that the dragon was a green dragon, nor that green dragons are immune to acid and have an acidic breath weapon. Heck: I don't think I would even have called for a skill check for that one.
So, what do I do?
Note that nowhere did I recommend volunteering information. Rather, I let the players ask questions then decide whether the information is something that they would trivially know ("green dragons are immune to acid"), they would have a chance of knowing ("great wyrm green dragons can create treant servants" - at least, in Pathfinder, which is where I spend most of my time), or would have no chance of knowing ("the green dragon Pahbelrii had chicken for dinner last night"). In the middle case, I set an appropriate DC (fortunately, there are guidelines for that), and ask for an appropriate check.
Now, there are things that you can do to hint at the questions the players might ask. To hint that vampires are always evil, perhaps the NPC will make a point of visiting the temples of the good-aligned deities in town, offering a short prayer and a small donation. The PCs are free to ignore this behavior, but it's something that they just might ask about.
To convey that vampires can turn people in a single bite, perhaps the NPC will wear a leather or metal collar, separate from whatever other armor they might wear. Maybe they make a point of putting holy water in their waterskin ("just in case the vamp takes me over while I'm thirsty; maybe it'll choke on it"), or they could even ask the PCs why they're not taking reasonable precautions against getting bitten by such vile creatures.
An aside, on the power of creating vampires.
As Dan B mentioned in their answer, turning creatures into vampires simply by biting them makes vampires extremely powerful, able to take over whole villages in a single night or two. It also opens up a lot of questions about what happens when the PCs face a few vampires and inevitably one gets bitten: are you really going to take their character sheet away and run Cleric McPelorson as the vampire's new thrall just because the vampire got lucky on one attack?
Please consider using something like the 3.5 version of creating vampires:
A humanoid or monstrous humanoid slain by a vampire’s energy drain rises as a vampire spawn 1d4 days after burial.
If the vampire instead drains the victim’s Constitution to 0 or lower, the victim returns as a spawn if it had 4 or less HD and as a vampire if it had 5 or more HD. In either case, the new vampire or spawn is under the command of the vampire that created it and remains enslaved until its master’s destruction. At any given time a vampire may have enslaved spawn totaling no more than twice its own Hit Dice; any spawn it creates that would exceed this limit are created as free-willed vampires or vampire spawn. A vampire that is enslaved may create and enslave spawn of its own, so a master vampire can control a number of lesser vampires in this fashion. A vampire may voluntarily free an enslaved spawn in order to enslave a new spawn, but once freed, a vampire or vampire spawn cannot be enslaved again.
It's a fairly small change - a vampire can still turn a whole village in a few days if they really want - but it places some limits on the scope of the undead army the vampire is willing to raise. It also gives the players a little time to prevent their fallen comrade from rising as a vampire, even if they can't bring their friend back to life.
Gotchas are tremendously risky.
I'll be frank here: "gotcha" moments suck* for the players. The GM already has a tremendous power imbalance, since they provide the players' interface into the game and adjudicate the actions the players attempt to have their characters perform. Throwing a "gotcha" on top of that will (IME) tend strongly to make the players think that the GM is playing the game by themselves and that the PCs are just along for the ride.
* well, almost always. It's theoretically possible to pull off a great "gotcha" moment but, doing so requires being clever. As John Scalzi says, "The failure mode of clever is “asshole.”".
Now, a foreshadowed reveal - something the players could have put together themselves but didn't - that can be awesome. But, how do you do it? Oftentimes, it's simple: drop a few hints and let the players simply not ask the question. For example: if the NPC stops in at the good deities' temples and puts on a Bevor while preparing to go fight the vampire, my experience is that it's at best even odds that the players will even remark on it, let alone ask questions. Then, when the NPC comes back as an evil vampire, the players might be able to connect the clues and realize what's happened.
But, don't be surprised when the reveal falls a bit short, especially in this particular case: as mentioned, everybody in the real world knows that vampires are always evil and that getting bitten by a vampire can turn you into one (though the exact details are a bit fuzzy). Seeing someone get bitten will cause any player I've ever seen to start asking about how to prevent them from turning.
And, for good measure, railroading is tremendously risky.
I'm particularly concerned with:
In the quest, they discover that the bad guy is a vampire when they confront him, but the NPC still rushes him down, gets bitten, and falls ill. The PCs manage to bring the NPC to some hospital, and he recovers.
As the GM, there is no possible way you can know that this is how it will down. Maybe the PCs get the drop on the vampire (I've seen parties pull tricks out of their sleeves to kill the big bad before it gets a turn, all completely within the rules). Maybe the NPC is restrained by the rest of the party. Maybe the vampire misses on the attack (there is an attack to bite the NPC, right?). Maybe the PCs get seriously injured half way through the dungeon and turn back, deciding that they're just not ready for that particular challenge (I've never seen it, but it could happen, right? 😁). Maybe the cleric has a relevant "remove disease"-type spell available. Heck: maybe the PCs kill the NPC to put them out of their misery and find a nice hallowed graveyard from which no undead can rise (or bury the head and body far apart, with a stake through the heart, or get creative with spells to fully entomb the corpse in granite or petrify it or something).
There are any number of things that might happen that prevent "the NPC rushes the vampire down, gets bitten, falls ill, and vamps while off-screen" from happening. If the PCs are in the room where any of it happens, you cannot count on any particular series of events happening.