As far as I know, while they might be using a botnet to geo-unblock streaming sites (which is what many VPNs do, and at least somewhat shady/ethically dubious if it happens without explicit user consent of the users whose devices/networks are being used), there isn't any evidence for NordVPN users being used as a botnet.