Look, if you don't know how legal standing works, that's one thing. But to reject the explanation provided to you and to cite your own ignorance as a legitimate source of disbelief while you poo-poo away a dispositive fact isn't reasoning.
This long period of inaction, from 2016 to now is unacceptable.
If they would have acted, why didn't they do it before Facebook?
If there wasn't precedent that Apple's TOS venue clause was binding, then the case would have been thrown out as I just previously explained.
"If they would have acted, why didn't they do it before Facebook?"
Because the case would have been dismissed as I just explained.
In reality, Apple has been reacting to and fixing new exploits all the time, with NSO Group (and others) successfully finding new ones to replace those that got patched.
For instance, the main class of NSO-related attacks has been via the Messages app and related frameworks, which were relatively poorly designed in terms of their original security architecture. Apple has since 2016 substantially hardened those subsystems, including with a new 'BlastDoor' isolation layer specifically for Messages in iOS 14. That closed off entire classes of exploits, but is clearly not perfect.
...Or when Facebook eventually followed up, you'd be making the excuse Facebook was justified in waiting for Apple to test the waters? Somebody has to move first.