How do you identify a target individual purely from source traffic metadata...? Sure, you can identify them if you've totally rooted a target's phone and uploads all the data such that NSO group can read it - my point is that NSO group could offer transit encryption so long as they haven't backdoored whatever client is being used.

The reason I bring that up is that it's precisely the service you might offer if you wanted more plausible deniability. I still don't consider this hugely complex stuff.