The simple answer is that to the people that really matter in decisions like that, those in the intelligence and the state departments of countries like the US, software like Pegasus is an important tool in staying ahead of adversaries. And in order to do its job effectively, it’s best if people don’t know about it. Pegasus may be sanctioned, but another company will make a product to takes its place and the game will start again. A similar argument can be made in favour of keeping the Saudis on side; they are useful for what they can do to help attain the foreign policy goals of the US and it’s allies. Those goals are mostly related to making sure the US continues to have access to all the stuff they need to stay on top of the geopolitical tree

Because that would set the precedent to sanction the government that rubber stamped the selling of Pegasus also.

Because it’s easier?

That government is an important US ally.