It has been established that there is a clear link between NSO and the Israeli government.

Not technically but an Israeli cybersecurity company like this isn't exactly two guys in garabge bootstrappy capitalist success story you're making it out to be. It most likely is filled with spooks, has deep connections with the Israeli intelligence services, and is full of ex-military. In authoritarian or semi-authoritarian regimes spinning off hacking to a private company pays dividends, because they get blacklisted, as a private company, which doesn't greatly affect diplomatic norms. Also it allows Israel to sell exploits to regimes that might be hard to via government agencies. Afterall, it was "private" business that sold them, not the government, wink wink. A bit like so many "private" cybergangs in Russia have impunity to attack the USA/EU and sell and deploy ransomware there because, again, its "not the government, its criminals" but in reality they're defacto arms of the governments there or at least have strong ties to the government, pay them protection money, and often get marching orders from them.