Like many aspects of security, it's not about stopping every possible instance of a bad thing from happening, it's about making bad things less likely to occur.

Like many aspects of security, it's not about stopping every possible instance of a bad thing from happening, it's about making bad things less likely to occur. If Saudi Arabia has to develop their own 0-day spying toolkit instead of buying one off the shelf, then at the margin they will be able to do less spying. There's nothing stopping Saudi Arabia from setting up their own team to build such hacks, but it would cost them more. Further down the road, there's nothing stopping a bunch of smaller countries from teaming up to get the economies of scale that NSO brings by selling to multiple countries -- but these toolkits seem to be the sort of closely guarded secrets that even allies don't share (if the NSA is anything to go by they are more likely to use these techniques to spy on their allies), so I doubt that is very likely; could be wrong on that point though.