> doesn't mean they knew about this

Mitigating but not exonerating. (Also, unknown and possibly unknowable.) NSO are still selling cyberweapons hitting the United States. If they didn't give a shit about keeping an eye on their kit, that's a negligent gap in oversight by Jerusalem.

It's a good thing we have a talking-not-shooting relationship with Israel. The U.S. would be within its rights to launch a proportional counterattack were that not the case. If Israel doesn't deal with this properly, there's a decent chance we'll see calls for criminal penalties and targeted sanctions.