They don't state it clearly but this was a "we are capable not to mess up" audit rather than a "we are keeping your promises" audit.

I believe it is relevant to the threat model of an attacker gaining (partial) access to a production server (eg no accidental logging), not to the threat model of mullvad deploying malicious code.

I feel like this is a meaningful audit but would have liked if they had stated this more explicitly