Phone companies charge governments to tap a phone line this isn’t that different with the only exception that phone companies usually have to only follow requests made within the country they operate in and those are usually backed by a warrant.
Like with any complicated tech things are a bit more involved since their exports are controlled under the same regime as weapon exports do in Israel they likely have some oversight to ensure that their tech does not leak out and isn’t used outside of the bounds of what was agreed on at levels that go beyond NSO as a company itself.
These exports were very much part of the Israeli and quite likely the US foreign policy.
Some deals like the one with KSA probably should never been greenlit but many others unfortunately have had the outrage steered away from the main culprits.
Amongst their exports they’ve also exported it to European nations such as Poland.
Poland an EU and NATO member had used this software to have one of its government agencies spy on a prosecutor in charge of an investigation into some of the leading party’s members, however it didn’t seem to generate as much outrage and what little it had was directed as the NSO or Israel which is laughable.
Poland isn’t a state that normally could fall under any arms embargoes or export restrictions.
This software had likely very little to do with Khashoggi‘s fate, they didn’t use it to lure him into a trap or to track him for an assassination he was killed in an embassy after being invited to come in, and he came in out of his own free will.
I’m far more interested in how some of their western clients have used this software and unfortunately so far no one seems to want to pick or steer the story that way.