What this article is missing is that the hackers had root access and had NordVPNs private key for their HTTPS cert for several months in 2018. This went undetected for months and they're only now publically admitting what happened due to press attention. Their public response seems to be "it's not a big deal guys, mitm is hard".
> The key wasn't set to expire until October 2018, some seven months after the March 2018 breach
And here's a dump of their logs: https://share.dmca.gripe/hZYMaB8oF96FvArZ.txt