From the article:
"“One of the data centers in Finland we are renting our
servers from was accessed with no authorization,” said
NordVPN spokesperson Laura Tyrell."
I believe that would be the section they're referencing.
“We failed by contracting an unreliable server provider...”
They are casting blame on the provider. Providing remote access tools is not a fault. Failure by NordVPN to disable said access is the issue, yet they passed the blame on.
I believe that would be the section they're referencing.