I think your last sentence is key. The NSO as far as I'm aware to targets people on an individual level. It's not hard to phish and hack a single individual as

I think your last sentence is key. The NSO as far as I'm aware to targets people on an individual level. It's not hard to phish and hack a single individual as a large organization. It's just a matter of resources and slipping up eventually. With that being said, the exploits they find are interesting and I wish they would publish them in a white hat manner instead.