I want the option where NSO loses but the money goes to the actual victims instead of Zuckerberg
"Punishment has five recognized purposes: deterrence, incapacitation, rehabilitation, retribution, and restitution" [1].
You're describing restitution. We're still on deterrence and incapacitation, i.e. fining NSO so it stays away from America and possibly putting it out of business so it can't keep selling its wares.
[1] https://open.lib.umn.edu/criminallaw/chapter/1-5-the-purpose...
Every victim has family or friends or things they cared about publicly (usually the public presence is the reason they became a victim).
Justice can be found in many ways.