The NSO created/ran cloud instances for each client country and reviewed and approved every target. The didn’t sell weapons like in your analogy. They were eff

The NSO created/ran cloud instances for each client country and reviewed and approved every target. The didn’t sell weapons like in your analogy. They were effectively assassins for hire. The problem with selling exploits is you want to maintain “ownership” of the exploit details, lest your customer just take the exploit and sell/use it without paying more or use it to attack you or your friends. This means you end up with veto power. I.e. culpability.