If you look at the list at https://en.wikipedia.org/wiki/Pegasus_Project_(investigation... it seems like most of the countries that used pegasus are still on the allowed list, many of them much more extensively users than mexico was.

I really dont think nso group client is the pattern.