The only things I can imagine here are because they had a data breach where the attackers could see the traffic of users and aggressive advertising, which is tbh just annoying. That of course doesn't mean they're bad in terms of their user's privacy.
Mullvad has been visited by the police but Mullvad couldn't deliver them what they wanted because they don't keep data of their users. This is proof that they truly don't keep logs. This incident alone makes me personally prefer Mullvad over NordVPN.