It means, among other things, that no US company or person can sell them technology or offer technical services under threat of significant penalty. How is that meaningless?
I certainly wouldn't send technology subject to export control to anyone I knew to be a part of NSO Group or any successor.
This is the U.S. Treasury. The concerns you're worried about have been contemplated.
If they really wanted to stop this kind of activity, they'd sanction the individuals involved. This would deter others from forming a successor - would you accept an extremely well paid job if there was a risk that the US will put you on its official international shitlist for that?
That's not how the Entity or SDN lists work. Every individual ever employed by NSO Group is going to start having difficulties with their bank and securities accounts starting today. Affiliation with a blacklisted entity moves you from "person who does not generate hits on OFAC" to "person who does." For many institutions, that's a dealbreaker.
You can't get around a blacklist by shutting down shop and re-starting under a new name. These are old, battle-hardened tools originally designed to go after state actors. The loopholes have been thoroughly explored.