The next step isn't to blow them up, the next step is to sue them.
I just assume the IDF and Shin Bet would like to be the only ones who blow up civilians in Israel, but I can't think of a single reason why the Israeli government would oppose an extradition request if they were presented with evidence of cyber-whatever.
Because they want to foster such companies, and not deter people from founding them by showing them that they will be extradited to the US?
If that's true (which would be disappointing when you consider what "such companies" means in context) I assume the Israeli government already have "entrepreneurs" ready to jump into that market if they haven't already. "Showing them that they will be extradited to the US" if they fuck up in a conspicuous and public manner that is problematical for Israel and her allies might be considered a win by everyone involved except the NSO executives involved.
Of course, politics is complicated and NSO might have powerful friends in government. Or the Israeli government might be complicit in some ways that they really don't want to become known. So who the hell knows?
If an American company would get caught doing the similar, would US allow extradition request of those people to some other country?
This is what extradition treaties are for. The specific laws involved and the evidence matter a lot.
Except the really obvious detail that most normal countries won’t extradite their citizens? Israel loosened up their laws on this a bit after the Sheinbein affair, but extraditing resident-citizens remains a rather unlikely prospect.
I can’t even guess why you’d believe that. Participating in extradition treaties is the norm, not the exception.