Big nation-state security agencies do it in-house, like NSA's TAO. Israel itself wouldn't rely on NSO, quite the opposite: NSO is alums from Israel's Unit 8200 (IDF signals intelligence) repackaging a dumbed-down version the know-how they learned in the military for retail sale to tier 2 and 3 countries that don't have the capability, or to police departments that don't have access to national-security-grade spyware.
I know some Unit 8200 alums, and they are scathing about the ethics of their former colleagues who went on to work for NSO.
I know some Unit 8200 alums, and they are scathing about the ethics of their former colleagues who went on to work for NSO.