It's the latter case; Nord used a third-party residential proxy service that they sent traffic through, but there's no serious evidence that they used their own users as proxy nodes or endpoints.