I think that you are misinterpreting this statement as a general caution.

Sending a company proof that you've accessed a security hole (e.g. demonstrating it to them) can and has been prosecuted against has a hacking attempt and/or unauthorized access.

This is something every security researcher should know, and not necessarily pejorative against Nexmo in particular.