Re: I had not thought this possibility through
I wouldn't characterize them that way. While they are making weapons, I think "cybercrime organization" or to use a more technical term "advanced persistent threat" are better terms for what they are. A weapons manufacturer usually has some degree of trying to adhere to laws, for example making sure the people selling their weapons to evil people is some middleman they don't know. NSO doesn't bother with that distinction.