Nord had a breach many years back and didn't disclose it to customers for a few months. Their reasoning was they wanted to make sure all holes were plugged first. I don't really trust them simply due to their advertising.

I just went through all this and settled for IVPN. They haven't done anything wrong that I know of, their app isn't terrible like AirVPN's Eddie, and they have private payment options if you prefer to pay with cash or crypto. Their number of servers is more limited than other options though, so it does depend on your location.

Mullvad is probably still the best option if you don't mind the co-owner donating tons of money to a far right party. The rest of the company said they weren't happy with that, but it's not something that can trigger any action on the part of the company. I assume all owners of these companies are libertarians at best.

If I still needed port forwarding, I'd probably go with Proton, though I am reading a lot of their servers are getting blocked by sites that are starting to recognize them.

Surfshark and Nord are owned by the same company afaik.