NSO effectively operates a SaaS platform for target exploitation and collection. They can easily add a restriction that prevents specific phone numbers from being targeted.

My guess is that such a restriction is in place to meet contractual obligations. If you weaponize an exploit against US targets, you'll never get a US based broker to sell further exploits to you.