Re First:
That’s between Aaron and the phone company. She was on his plan, I see enough reasonable scenarios in which she has the permissions on her account, set by Aaron, to see that. I’m gonna guess the phone company has that set up properly, and Aaron had just no OpSec in mind.
Re Second:
An NDA does not cover criminal activity. So it doesn’t apply to things that basically directly relate to the criminal activity.
If Nick is snorting coke with a firearm in his other hand whilst being pegged by April, it’s free game.
If Nick snorted a line in the kitchen and after 15 minutes Aaron and he walked to the bathroom, got butt naked and sensually touched tips before playing synchronized helicopter, I would say the latter would be covered by NDA, as it’s gay and not related to criminal activity.