Because they don’t have a large local market like the US does.

The US can pay market rate or even well above it for contractors that would do the same stuff for the NSA and other organizations, Israel has a much less lucrative local defense market hence why they are focused on export.

Combine it with a mandatory service in which the Intelligence Directorate gets to pick the top of the top rather than just form those who volunteered for service and you get a large number of brilliant minds that spent 3-5 years if not more of their life doing this for little to no pay coming out to the private sectors with plenty of offers to put their talents to use.

Spice in some report-bias as well. NSO is doing great PR work. Others may prefer less public exposure.

Zero days are one side of it, the other is the incredible number of cyber security companies born in Israel (or abroad by Israelis). Checkpoint, Imperva, RSA, Palo Alto networks, CyberArk and dozens more (and I only listed the ones that IPOd).

Sure

Its a mixture of coincidence

Plus consolidation of PhDs, and extremely high education including in computer science

Plus heavy conscription into military service including intelligence community where this adversarial thinking is necessary

Plus general amorality to who these weaponized software exploits can be sold to, and proximity to interested parties