Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated guess here?
Amnesty International has specifically criticized NSO specifically regarding UAE activist Ahmed Mansoor. He is currently serving 10 years in jail. UN human rights experts considered his arrest and imprisonment "a direct attack on the legitimate work of human rights defenders". He was monitored by the UAE using NSO technologies.
Amnesty International have also complained that they have been targeted with NSO Group technology - specifically Pegasus. They're currently launching a legal case in Israel to restrict their export license.
A separate case claims that NSO Group used Pegasus to help the Saudis spy on Khashoggi, who was brutally murdered in the Saudi embassy.
I don't think we need to argue about the bad guys in this case.
Sources: https://www.amnesty.org/en/latest/news/2019/09/nso-spyware-h...
https://www.amnesty.org/en/latest/news/2019/05/israel-amnest...
https://www.nytimes.com/2018/12/02/world/middleeast/saudi-kh...
I'd say the upsides outweigh the downsides.
It also seems like you could discover the bug from public sources - it had been created and fixed in the kernel. Apparently at the time not registered as a security issue, but review could discover the link and check for Android's not having the fix.
In the case of Android, "just tell the vendor" is also kind of awkward: There's dozens, if not hundreds of those. If there's an active threat, it's kind of hard to justify not to inform all of them, but could you trust an embargo over so many parties?