It's hard to tell from the article where to draw the line between the Raytheons of the world and NSO Group. Is business only allowed to sell dumb weapons to government?

Looks like international trade in zero-days already is treated as potential weapons[1]. Is the point that Facebook et al object to being primary targets of hostile international actors? Using the same logic, though, if I'm feeling insecure about foreign air power do I sue JSC Sukhoi Company?

[1] https://www.justsecurity.org/5703/export-control-arrangement...