I’m also a NordVPN customer, and not only I do not use 2FA, I deliberately use easy to guess, previously compromised passwords. I’ve also handed out those credentials to plenty of my friends.
Just in case they happen to log the network activity of their users, what this can achieve is plausible deniability and noise. Lots of noise.
For comparison, mullvad accounts have no separate identification and authentication. Each account is a 16 digit number, and knowledge of that number allows you to administer the entire account. Usernames and passwords don't exist
Yeah this was a huge learning curve for me. When you use a Mullvad OpenVPN config file, the username is your account number, and the password is the account number too.
All a bad actor has to do is enumerate account numbers programmatically and they could potentially own hundreds of accounts, although generating those would be difficult and a lot of it relies on chance.