The US could say “tighten controls on your defense contractors or lose our support” and then do that if they don’t listen. That’ll never happen though. I’m sure plenty of TLAs use NSO software.

That doesn’t stop the DoJ from extraditing foreign nationals who never set foot on US soil before.