Absolutely, Nord is a sh*t company when it comes to privacy, they removed the anonymity claim as well recently and changed it by "Security", but anyway a VPN is far (very far) from being enough to reach decent level of Opsec. Anyway, VPNs that care can start use Enclave at the very minimum, but it's insufficient as traffic can easily be correlated if you disconnect peers one by one (gov can just sniff DC firewall, then DDoS each IP connecting through it, check if the guy is still online... (ton of ways)). Mullvad is clearly more trustable regarding the steps taken to ensure more privacy, but it's not enough on its own and even them say so.

For Bitwarden, well, US government (and Google, and more) is aware of your usage of it through their analytics so I wouldn't say it's really privacy respecting but sure, there is a bigger effort yeah.