The NSO group has been entrusting its vulnerabilities to people who would happily embezzle if it is some sufficient amount of money. If the bounty is ~2X these people's typical price in many countries that are NSO Group clients, then it is remarkable these bugs aren't being burned as a form of embezzlement. Your description of tranched payment risk only makes that more remarkable.
As such the NSO Group would end up limiting its clients to fit its pipeline and have trouble buying exploits since most other market participants have a single workforce with a drastically lower rate of loss.
I think that would devolve to countries needing to pay liability pricing per attack on possible honeypot phone's, etc, and more countries being cut off like Morocco, so no more using it like an unlimited plan. Sure these countries have unlimited budgets relative to their own GDPs, but when they can't find stability acting as a group they are all back to bidding for unique vulnerabilities, and there probably aren't 212 great ones on every platform at all times.
NSO builds implant technology, so they add some value of their own, but NSO is essentially a middleman in this market. Driving up the prices of the underlying asset, when buyers aren't price sensitive, helps the middleman.
It would be interesting to see how high the prices really go - at some point NSO clients might see more efficiency in going for more traditional military means.