It's my understanding that NSO runs centralized command and control servers that their "clients" are granted access to, for both the on-device payload installation and also data exfiltration.

They do not give the software to their clients to go use somewhere in the world fully independently (self hosted payload dropper, C&C, etc)

They're a direct participant in the network traffic. Unlike a dumb purely offline piece of hardware like a M4 rifle or similar.