Did they consider that maybe all the clients are NordVPN customers, i.e your data will come from a different users internet connection but another users data comes from you.

With that there world be no reason to have any hidden malware practice or similar, it _could_ even be in the terms of service if some of their products...

I mean it's true that there is a lot of bs going one but before claiming them for having hidden malware you should make sure they do, instead of just saying "that's the only way it's possible' even if it isn't the only way.