Earlier quoted context omitted.
"NSO can be sued under California law because they accepted the EULA" seems like a mechanical, strict, pedantic application of law though.
How does that seem pedantic? It's incredibly straightforward. On the other hand, creating some kind of convoluted, contrived paper trail to claim that mysterious third parties were the ones to have physically pressed the "Accept" button on your 100 fake accounts and so you didn't even know there was a EULA seems kind of like it might actually be fraud.
I don’t see how this differs much from a common “clean room” reverse engineering strategy where one set of engineers accepts the eula and then writes down in excruciating detail exactly how the target item works, then a second set of engineers that have never seen the item in question (or accepted a eula) takes these detailed writings and uses them to reverse engineer the item in question. (A mere description of a device or software is not protected)
This is standard practice at large companies when reverse engineering chips, devices and software and seems very similar to the above eula argument.