Then, there’s also a group of countries that simply cannot afford / don’t have the people to do these things.
How do I know? Consider the usual suspects for these operations: the US, Israel, Russia, and China. For every single one of them, we also have examples of their work that got leaked or otherwise exposed.
What are the chances that Belgium happens to be the country that manages to run such a program and keep it secret? Or Equatorial Guinea?
Then, there’s also the growing list of known customers of NSO: if two dozens of them decided to buy this software, chances are they do not have homegrown solutions with similar capabilities. Nor does it seem as if there were any other sellers at NSO’s scale. Meaning: if we successively learn about all of NSO’s business, we might be getting close to knowing everything there is to know about the sector, with the exception of the large countries mentioned above.