It doesn't run live on your phone—rather, you back it up using Apple software and then run the tool on the backup. So it never touches your phone directly.

Are you saying Amnesty International is distributing Pegasus in open source software? Hmmm...