That's an interesting comparison. But one difference is that bombs and guns can be used against any target (any human, animal, building), as well as non-violent

That's an interesting comparison. But one difference is that bombs and guns can be used against any target (any human, animal, building), as well as non-violent targets such as for practice, competition, entertainment, or for intimidation (e.g. mutually assured destruction). Whereas Pegasus was designed to exploit a specific WhatsApp vulnerability, and to interact specifically with WhatsApp's servers. And NSO had paid support relationships with the organizations doing the attacking. Another difference is that NSO employees themselves had to reverse engineer and exploit the vulnerability during development (possibly illegal under the CFAA). This action also violated WhatsApp's terms of service. There's no parallel to this with guns and bombs. Another difference is that according to the complaint, NSO-operated servers talked to the exploited devices. So this wasn't just a tool that NSO handed over to governments to be used (like guns and bombs) and then was uninvolved in, it was a service that NSO operated, and governments issued commands to the service telling it who to attack.