I have yet to deep-dive into the techical details of Pegasus so this is pure speculation, but if Pegasus demonstrates the feasibility of deploying and executing arbitrary payloads on remote devices without the owner's knowledge or consent wouldn't that raise a blackmail vector with this new program? Again I'm not familiar with the specific exploits used by Pegasus, but is there anything stopping another malicious actor from relying on the same exploits to say install a bootloader that downloads images that would trigger a positive scan?