Well, technically NSO needs permission from the government to sell Pegasus, so those aren't really "private companies" either. They are private arms of the state.