Well. If they sell spyware to others, they should at least ensure/check, that it is only used against criminals and by democratic states.
But still no good solution.
And criminal would be too far, as such spyware should only be used against extremely serious crimes, e.g. warcrimes or terrorism
What you call serious crimes are highly political topics. Ones hero is anothers war criminal, and the same guy may be both freedom fighter and terrorist, depending who you ask.
https://en.wikipedia.org/wiki/Wassenaar_Arrangement#2013_ame...
Passing the buck is not an option if one wants to stay with the Wassenaar agreement. But then USA found a way to skirt around Geneva convention too during Iraq war.