They can also threaten to drop susidizies and to kick them out.
I'm actually hugely wary of EU interfering in state affairs, because the EU is not some 'magical good guy' - they're just usually 'somewhat gooder'.
In particular, Poland refuted the ECJ as having ultimate authority over local courts, the EU threw a huge fuss - but Poland has substantial backing for that: there is nothing in the treaties which indicate ECJ has said authority. At the very same time, the issue is not resolved even in Germany, and the German high courts are thinking of pressing a case. Since Germany is the 'centre of the EU' - and - there are gaping holes in the true legal authority of the ECJ for certain things, it's not a war that the EU wants to get into. It could tear a mile wide hole in the legal fabric of the EU. That said: I wish the would do it because the situation is unconscionable and almost nobody is aware of it.
Using Pegasus to spy on political opponents however, is a bridge way, way too far. Poland is not going to have a leg to stand on either moral, populist, legal, treaty etc. - there's just no argument they can make.
I think the EU should put a lot of heft behind this issue though.
Finally, bit of a caveat, it could be that other EU states are using the same or similar tech to do 'similar kinds of things' - those EU states are not going to want to be embarrassed by public knowledge or airing of that. So that could be a problem.