The moral issue aside, I can't even begin to fathom how their software would even work. How do you stealth install software to a random phone out in the wild? Social engineering, or purely technical?
The target is sent an SMS containing a link to site that triggers the explot chain to remotely jailbreak the phone and clandestinely install the monitoring software.
Ahmed Mansoor, a UAE journalist, was recently targeted with one of these SMS messages and was immediately suspicious. Instead of clicking the link he contacted Citizen Lab researchers who connected it back to NSO group.
[1] https://citizenlab.org/2016/08/million-dollar-dissident-ipho... [2] https://news.ycombinator.com/item?id=12360662
* when the target isn't already paranoid due to previous attacks and the bait isn't quite so pathetic in its construction...
Edit: I imagine they went with the SMS method due to its high accuracy and low risk of detection from third parties.
A webkit 0day could've been delivered via a watering-hole attack or something even just a tiny bit more sophisticated (compromise a trusted contacts social media account, send the link from there) and succeeded.
Whoever put the effort/time/money into developing the exploit chain is likely pissed off it got burnt via such an amateur delivery.