Here is the explanation from the YouTube documentation:
This request does not require authentication, but you will only be able to retrieve the contacts of users who display the Friends module on their channel pages. (If a user's contacts are displayed on the user's channel, then the user is already making the contact
list public, and YouTube therefore allows API clients to access that same information.)
If you try to retrieve contacts for a specific user who does not display the Friends module on his channel, the API will return a 403 (Forbidden) HTTP response.
So it's up to each YouTube user. If she has chosen to make her contact list public, then NodeXL can get it. Otherwise, the information is private and there is nothing NodeXL can do about it. So yes, this is permanent behavior.
I do need to find a YouTube user who has made her contact list public and use her in place of the current "andyland74," who is now private.