Do they sell the tech or the service? A business modelo where NSO decides for themselves whether a victim merits hacking seems more defensible than one where they imagine they can tell that a government will never do wrong if it owns the tool.
Carefull with that conclusion. The article linked by you says “Israeli surveillance companies have been refusing to service and support spyware used by Polish intelligence agencies”
That sounds more like the NSO is not sending them updates anymore, rather than that they got “banned”.
This would however destroy the "we only sell the weapons and can't decide how they're used" defense, as well as having to be thoroughly informed about each target.
