The way I read that report: NSO has a policy of only selling to governments for anti-terrorism and law enforcement purposes; the Mexican government is a customer; the cartels have insiders in the government and/or have obtained the software from the government.

Sort of a corollary to government-mandated encryption backdoors, any offensive software under the control of a government should be considered public knowledge and integrated into your threat model.