I think it seems strange where we imagine that tools are neutral. But they aren't, necessarily, and especially if the organization/developers knew they were building something to be used unlawfully, it's reasonable to hold them accountable.

Taxi rides are generally neutral, too, but if someone hops into your taxi, asks you to drive to the bank and wait, and tells you outright that they're going to rob the place, that makes you a getaway driver with a taxi, not a taxi driver who happens to have a guilty client.

I think there are three reasons it makes sense:

1. The company enabled several different organizations to spy on dissidents (it’s easier to sue one than many)

2. The company advertises its services to be used as such, and

3. It’s easier to sue a company than a country, and much easier to sue a company in Israel than to sue the UAE in a UAE court

Why is this strange? You sue the company making the tool then they tell you in court it's not them but rather entity X who abused it and give you the documents to prove it. Then you sue entity X.