Of course, NSO and other players in that field can do much, much, much more than advertised to the media. Remember, the vast majority of people working for NSO

Of course, NSO and other players in that field can do much, much, much more than advertised to the media. Remember, the vast majority of people working for NSO worked for Israeli and US intelligence bodies. They serve in the 8200 unit doing malware analysis trailed by the NSA and then go work for NSO on the same sort of technology. (If you want to get an idea of how much, I recommend "Permanent Record" but if you don't like Snowden then check out how far ahead intelligence bodies were _historically_ compared to public knowledge - WW2 crypto being a good analogy) This lets the US government (and the Israeli government in turn) to make money off the technology without going through the same international regulatory systems. The US government (or Israeli government) can stop companies like NSO in a single decision but they are not since it is making them money. It's up to us (the citizens) to pressure them to do so and to promote security best practices and work on better tools to make it harder to breach peoples' privacy.