> I thought they were based in Israel and basically have protection from the Israeli government.

NSO does business via various parent corps, subsidiaries, and other entities around the globe. https://en.wikipedia.org/wiki/NSO_Group#Overview