Nation-state has at least two specific uses in its field of origin (political science), which are closely linked conceptually though very different. It can mean either a state that is approximately one-to-one with a nation as became something of a European norm after after the Peace of Westphalia, or it can be the structural kind of sovereign that became the norm in the same space after the peace of Westphalia (a synonym for the latter sense is “Westphalian sovereign”).
When the context is more legal/structural the latter use dominates, when it leans more to the social the former use does.
The cybersecurity use matches the latter use.
From this map, you can clearly see that Microsoft uses nation-state and country interchangeably
You may be right in poli-sci class, but that's just how it is in cybersecurity. To use your framework, it would be like me colloquially asking "do you have a car?" and someone responding "yeah, a Jeep Wrangler". Car = automobile. But I wouldn't be that casual when filling out my auto's title information.
It's like saying 'I saw a 2019 Ford Focus in blue' and then when someone points out it was actually a green Dodge saying 'well I just meant any car why are you splitting hairs'.