NSO, while having the blessing of a nation state, is still a private company, but has access to some very high-end exploits that would almost certainly require a very large team to develop and to keep ahead of the fixes. It is just more likely they are going the cheaper route of buying the exploits and copy/pasting them into their system. This way they can outbid most others as they are reselling the exploits multiple times to many different nations - the other potential buyers, e.g. intelligence services are buying only for themselves and are limited in their budgets.

That's a serious accusation to make without evidence. Anyone doing this would rightly face significant jail time.