"AWS Nitro" is their new high-security platform, not generic EC2. The obvious implication is that they can "read, copy, extract, modify, or otherwise access Your Content" on non-Nitro instances.

Good for them, if it's really the case that they can't read Nitro EC2 instances. Of course, that still leaves S3, RDS, DynamoDB, Elasticache...