Nobody is buying products or services from Russia, they don't produce anything but oil, gas and other natural resources. They export almost nothing they make whether physical or technological.
That makes it kind of hard for sanctions to affect them, as the only leverage the west would have over them is not buying their gas but that's kind of hard for Germany and some other EU countries to avoid right now.
Putting sanctions on NSO Group probably won't hurt them too much since they don't make deals out in the open, but it is probably intended more as a warning to other companies in that industry to be careful who you do deals with.