Most likely the base/server tool "calls home". i.e. there is a client loaded on the target device, there is a server at the gov agency. The server has number

Most likely the base/server tool "calls home". i.e. there is a client loaded on the target device, there is a server at the gov agency. The server has number of uses and targets. When the uses are exhausted, it phones home to NSO Group. This is very much the model for other spyware tools, forensic tools, and phone repair tools. This would also work well with the objection that they "don't have servers in Cyprus". It also explain how NSO Group would know how many targets the tool maybe loaded on, but not actually have the list.