They sell fear (with some justification), and then they sell an underperforming product that supposedly addresses that concern.

It would seem that people do [think “oh shit I need to protect my security”, and then buy NordVPN, without questioning ...] or else they would have stopped all that advertising.

There's some truth to the fear they are promoting in some situations. I doubt most consumers are in those situations (ignoring people living under oppressive regimes, as presumably they aren't watching the typical consumer tech videos on Youtube). But like a lot of types of insurance, the consumers are convinced that they need the solution to the problem which they don't really have.