The Facebook lawsuit is older, hence why you are reading the judgement on an appeal of an appeal or something in that order. The timing on the Apple lawsuit is probably no accident; now that this "foreign state actor immunity" fig leaf is out of the way, the original lawsuit can proceed full speed ahead and is likely going to be fatal to NSO. I wouldn't be surprised if any victims of theirs similarly sue them.

ProPublica should probably get credit. Even if the companies knew before their reporting, the publicity surely spurred them to act.

It seems to me that this is the sort of thing that is sorted out between governments first - diplomatically. I am certain the lines between the NSO Group and the Israeli govt are pretty blurry considering they came out of the Israeli Intelligence Corps. If it weren’t an ally this would almost certainly be considered nation state actor activity eg Internet Research Agency.