So how do we protect our privacy from the advance of technology? It doesn't seem possible. Just going after NSO is useless.
It depends on what your threat model is. If its individuals, local law enforcement, or even national law enforcement (context dependent) you are trying to hide from, you can obtain phones with cash and make it very difficult to link them to you (use a sim card bought with cash and never give out that number, use a VOIP service for your primary number, use an OS that doesn't send back much telemetry, turn off location…
I was recently asked how to make an anonymous post to a local news organization where all they wanted to do was hide their IP. I said if their only worry is the news organization then a VPN would be enough... Now that I'm reading your comment I'm having second thoughts whether it was right.