Providing access to their services is very cheap and this cost will be easily offset by the percentage who either forget to cancel or willingly allow an autorenewal. These autorenewals are often $100+.
Those customers who got it for free will also sometimes be referring other friends/family who will pay full price.
I think its as simple as that.
These offers are only available to new customers, but many people try to game the system by pretending to be new users in order to earn cashback. Some do a bad job of pretending to be new and the cashback is declined, allowing the provider to keep the money.
If you are using these cashback offers be sure keep autorenewal enabled until cashback is paid out. I’ve heard stories of people having their cashback declined if they cancel prematurely.
Typically there are affiliate referral links so that NordVPN can pay out the affiliate according to their arrangement, but that links your client to that affiliate as a result.