This is the U.S. Treasury. The concerns you're worried about have been contemplated.
If they really wanted to stop this kind of activity, they'd sanction the individuals involved. This would deter others from forming a successor - would you accept an extremely well paid job if there was a risk that the US will put you on its official international shitlist for that?
That's not how the Entity or SDN lists work. Every individual ever employed by NSO Group is going to start having difficulties with their bank and securities accounts starting today. Affiliation with a blacklisted entity moves you from "person who does not generate hits on OFAC" to "person who does." For many institutions, that's a dealbreaker.
You can't get around a blacklist by shutting down shop and re-starting under a new name. These are old, battle-hardened tools originally designed to go after state actors. The loopholes have been thoroughly explored.
I certainly wouldn't send technology subject to export control to anyone I knew to be a part of NSO Group or any successor.
If you're an employee receiving salary payments from NSO, expect your bank to be unhappy with you.
Just like a NYT article accusing you of being a terrorist does not carry any official repercussions, it will certainly ruin your banking relationships.
Since checking all manner of sanction, exclusion, risk, etc. lists published by the government is trivially automatable it is basically a minimum standard, and even the simplest KYC systems are going to flag customers that appear on any of these. For more significant clients additional databases and analyst resources will be used that are likely to uncover a relationship with such entities, especially a simple and easy to check one like prior employment.
This is a world with few black and white rules, and banks are mostly not outright prohibited from providing services to high-risk customers. But higher and higher levels of approval will be required, and the bank will have to go into the situation knowing that they will incur extra costs in terms of analyst time, compliance work, and ultimately liability of potentially huge amounts of money. It will be difficult, although maybe not impossible, to convince a bank to work with you. Everything will end up costing you more. You will have to be very cautious because banks will sometimes change their risk evaluations and decide to terminate the relationship, and you will have to figure out how to start your banking relationship over somewhere else.
While all of this is required under various laws (federally things like the BSA, PATRIOT act, etc), statutes are intentionally vague about the requirements both because banks are encouraged (and pretty much required) to perform internal research and development to improve their AML/KYC methods, and because the system operates in part on secrecy - bank clients need to not know how AML/KYC analysis works in much detail or they may find a way to structure around it. Banks also share information with each other and with governments, much of which is done under strict confidentiality agreements for several different reasons.
Banks that get this wrong can lose hundreds of millions and occasionally even billions of dollars, so there's a lot of hesitance to take on risk. It's also generally perceived that enforcement is becoming more aggressive over time, not less.
Source: https://www.mckinsey.com/business-functions/risk-and-resilie...
FWIW It is practically illegal for banks to discuss their AML/KYC practices, nobody is going to go into detail about this.
Being employed, or even having been employed, by an entity on the BIS's Entity List will make doing business in U.S. and in U.S. dollars expensive and tedious. At the very least, you will impose ongoing additional costs for every financial institution you interact with.