Since this is an international issue and there's no global "legality", the effect is that locations matter a lot.
Presumably, the hacking was done by Saudi authorities from SA, using NSO-developed tools. Citizenship of the target is not very relevant, but it does matter where "the event" happened.
If the reporter was in Saudi Arabia when the hack happened, then Saudi laws apply and essentially Saudi government gets to set conditions on whether it was legal or not, and if it was forbidden by their laws, then what consequences (if any!) that should have.
If the reporter was in USA at the time, then it would be reasonable to apply US jurisdiction and try and investigate it as a crime in USA. However, Saudi Arabia can refuse to cooperate and even if USA prosecutors identify the culprits and convict them, Saudi Arabia can refuse to extradite them and choose to protect them. In essence, if it's not a random foreign criminal but someone from the actual foreign government that has harmed USA citizens in USA, it's not really a criminal matter as much as a diplomatic one, where all the other aspects of USA-Saudi relationships matter much more than any facts about the actual case; USA can choose to make a big deal out of it or ignore it, but historical precedent shows that it likely will be ignored as the Department of State considers all the other factors of Middle Eastern politics as much more important, SA could likely get away with literal murder (e.g. Khashoggi), not just some hacks.
In a similar manner, perhaps you could argue that NSO is an accomplice in that crime (I'm not saying that this would succeed - in general, arms exporters are not considered liable for whoever the purchasing country harms), but that essentially comes down to (a) whether USA prosecutors are willing to pursue this, and (b) whether Israel is willing to cooperate, as in the absence of specific treaties it would be legitimate for Israel to say "NSO did not violate our laws, we won't enforce any foreign judgements about this event"; if so, then any action would be limited to seizing whatever assets NSO has in USA (if any!) and/or trying to capture the involved people (if specific people can be identified) when they are traveling outside of Israel somewhere within the reach of USA. USA could apply diplomatic pressure to get Israel to restrict NSO, however, it doesn't seem likely that USA wants it so much to actually try and change that.
For another of your questions, sale of hacking software can be regulated by countries in whatever way each country wishes. In this case, as far as I understand, Israel treats is as essentially an equivalent of "arms export" where NSO has to obtain approval from Israel government for their foreign customers, but in this case it is not contested that NSO did have all the required approvals to sell their tools to Saudi Arabia.