According to an old product manual[1], NSO would have most likely have been aware of whom was targeted and the content being retrieved because NSO would generally run the anonymising nodes on the Internet and seemingly insist on installing and maintaining the servers hosted at the client site where data eventually ends up. There is a note saying that customers could set this up themselves but I suspect the countries involved wouldn't have the expertise to do so. Thus to a country such as France which has been targeted, they would have to assume it is actually Israel spying on France via proxy countries. The proxy countries in return got access to spying tools they'd never be able to build themselves to spy on dissidents and rival politicians.
Per [2], US and UK officials were also targeted. Perhaps this was less commonplace though because the scheme had a greater chance of being figured out (example means: [3]) and would then give the US and UK access to the target lists of Israel and proxy countries, and the exploits used. Perhaps this is the reason 'soft targets' (countries without big ICT spying budgets) topped the target list?
[1] https://s3.documentcloud.org/documents/4599753/NSO-Pegasus.p...
[2] https://www.washingtonpost.com/world/2021/07/20/heads-of-sta...