Maybe because the initial reporting got so much traffic, Citizenlab pushed far more resources into investigating NSO products? Maybe its political in nature? I can't imagine the reasoning is technical incompetence by NSO (have you read the FORCEDENTRY writeups? its insane). Maybe NSO's clients more haphazardly pursue targets, so there is a higher probability of recovering some forensic evidence?