It really doesn't cost them nothing - it makes them the target to offensive operations of other states. I'd be very, very surprised if NSO itself isn't hacked.