No one is immune to a breach. You're absolutely right. Which is why the response to the breach is what is so important.

NordVPN left the backdoor open themselves - they left a remote admin console enabled. Then, they proceeded to hold their silence for _six months_, before informing their customers... And take no responsibility. They struggled to even admit they got their dates wrong.

That kind of behaviour, and lack of transparency, is the problem. Not that a breach occurred.