It is stupendously difficult to make vuln-free software to the level where actors like NSO are unable to produce exploits. In many ways, we don't even really know how to do it, especially if you as a vendor don't write literally your entire stack. The folks at Google and Apple can rewrite everything in memory safe languages and use the absolute state of the art in static analysis and still fail because some Qualcomm chip in the bluetooth stack has a vuln or because of some side-channel exploit that works around the assumptions of any formalism.

NSO are selling weapons to authoritarian governments who use those weapons to identify and either jail or murder people they don't like. That's bad. End of story.