Sure, the US effectively blacklisted NSO, but they did nothing to Israel. Imagine if a Russian business was found to have hacked State Department employees phones. Would being a private company prevent Russia from being blamed, particularly if they had the kind of state connections NSO had?