Bad analogy
Gun makers can be sued if they create a gun that injures the owners, as in it was defective. What they can't be sued for is if someone uses that gun to kill someone else. Much like Ford can't be sued when someone in an F-150 pickup truck drives drunk and kill someone, or Verizon can't be sued if someone orders 100 kilos of cocaine over their fios connection.
What the NSO group is being sued for, is not the fact that they wrote and sold software that one of their customers might have misused, but that they hacked into Facebook servers in order to help their customers. They maintained an active hand in the use of their software (so more software as a service). If they had simply sold some software to whomever and said "good luck", they wouldn't be in a California court being sued.
Biting the hand that feeds IT
