To build on this, I don't think the US government sees NSO Group the same way they see foreign hackers. Federal law enforcement and the intelligence community probably see the defensive losses as an acceptable casualty if it means reaping the offensive benefits of NSO's software.

Edit: https://www.vice.com/en_us/article/3kxk9j/dea-didnt-buy-malw...

The Drug Enforcement Administration would have bought NSO's software, but it was too expensive.