Take the Saudis for example. They have a desire to hack phones, an unlimited budget for hacking tools, and no ethics. The market will create other players to capture the millions of dollars they have on the table, and they’ll do it out of reach of the courts.
WhatsApp is facing brand damage because people are hearing that they can get hacked (and in some cases, possibly die) if they use their software. Their two options are to either invest in better security, or use the legal system. I think it’s better for everyone if the only option is for companies to actually fix their software.
If WhatsApp paid whatever NSO does to acquire bugs, nobody would sell to NSO.
This is the same reason that Apple recently increased their bounty. Nobody was giving bugs to Apple because the grey market paid more.