According to the twitter thread, the certificate is generated and used locally on your computer, not remotely on the NordVPN servers. If this is confirmed it doesn't sound too bad, but if the NordVPN software is closed source it's still suspicious.

Don't use NordVPN

https://www.privacyguides.org/tools/#vpn-providers

Aha? And how’s this feature supposed to work without doing that?

but if you read the whole thread it turns out that's not really an issue as it's scanning just like any AV