How do you "not" allow them to operate? People write things like this that seem premised on the idea that Bahrain wouldn't have implant technology if you shuttered NSO, but the only thing that would actually change is who the invoice got sent to. These companies have an unbeatable value proposition, lots of competition, and the lowest capital investment requirements of any intelligence product.
I really feel like people aren't thinking this stuff through. Exploits and implants are not rocket science. There aren't a huge number of people in the world that are world-class at reliably exploiting modern targets, but it's not like there's just like 20 of them or something.
later
In case it's unclear from the comment: I don't think this is a good thing. I'm speaking positively, not normatively.