How is this legal and why companies like NSO and their principals are not being prosecuted?
I am not defending NSO here, but I just want to provide a sample of a simple defense of this. In practical sense, there is very little regulation in this space. And if you add to it some of the territories involved in that race, you will quickly notice that it may be hard to force them to do anything. They are sovereign after all.