I believe that the distinction lies in "state actor" immunity. A USA company selling stuff to USA state agencies won't be prosecuted by USA courts because that

I believe that the distinction lies in "state actor" immunity. A USA company selling stuff to USA state agencies won't be prosecuted by USA courts because that use presumably isn't criminal in US law; you could have legal challenges to the agency itself but in general the seller can assume that it's the responsibility of USA gov't if they break their own laws. An Israeli company selling stuff to foreign agencies that gets used "elsewhere" on other citizens won't be prosecuted by USA courts because they don't have jurisdiction and it's none of their business if some other government decides to wiretap or torture-murder some of their citizens in their territory with the assistance of that stuff. But if a foreign government hacks a phone of someone on USA soil, then that's a crime in USA and it doesn't matter if it was legal under their laws or they had proper warrants or whatever, USA law doesn't have an exception for that unless that wiretapping was done in cooperation with USA authorities under whatever procedures they consider appropriate. And if some company is complicit with assisting that crime then it can be targeted by USA courts, if it can reach their people or assets somehow. I.e. it's not that "doing this is unaccaptable as such", but "doing this in USA requires permission from USA - we had it, you did not".