Make selling/using these attacks against government or other users a terrorist level event. Go after the heads of NSO and their like.
I'd say at that point the companies would be absorbed into the national intelligence infrastructure of the host county and cease to be independent entities who can be bought for the highest bidder. And I know NSO is basically like that now, but
I'd love to see some criminal sanctions for things that their software has been used for stick.