What does being NIST-compliant mean?

I mean, seriously, the NIST CSF is a massive library consisting of hundreds of publications spanning, collectively, thousands of pages and controls. Is being NIST-compliant just saying they use some of those NIST publications? It begs the question: which ones? And how did you measure up?

I don't think NIST and ISO27xxx compliance are mis-stated, it's just that they're frameworks for measuring cyber risk; they aren't an objective standard for cyber risk. You'd need something like CMMC or their audit results to see what the standard is. And believe me, you'll want to. Plenty of orgs "use" NIST and still have terrible security because they have it scoped down to virtual irrelevance.