Some 0-days - sure. But we're talking about a major corporation continuing their business uninhibited.

If the NSO Group has been active for a number of years, couldn't Apple make an effort to purchase their products (through some third party, perhaps) and then reverse-engineer the vulnerabilities?