When I've taught and had opportunity to include an ethics discussion, Cellebrite has been the example I gave on the spectrum right before you cross into malware. AFAIK, they have no special government exemptions or other permissions to get around EULAs or library licensing, they just ignore it.

NSO group is worse after the pegasus debacle, but I think Cellebrite is only a stones throw away from being used to stalk and suppress benign soda tax advocates in Mexico...

Moxie at signal has an short writeup of the internals of Cellebrite: https://signal.org/blog/cellebrite-vulnerabilities/