Israel is very laissez-faire about regulating the tech industry because it employs almost 10% of the country. As such, offensive security companies sell to anyone who isn't on the US Sanctions list.
The question is which buyer did the attack.
Hidden between the lines of the reporting is that it might be Hungarian intelligence [0]
Imo, the bigger question is why Hungary, Poland, Spain, Greece, and Cyprus (all countries part of the recent EU Spyware Scandal) [1] continue to allow their Interior Ministries to attack the phones of both domestic and foreign opponents, and are abusing "Spyware for political gain" [2].
[0] - https://www.politico.eu/newsletter/brussels-playbook/orban-c...
[1] - https://www.politico.eu/article/parliament-defense-subcommit...
[2] - https://www.politico.eu/article/eu-spyware-probe-slams-gover...