Seems that the NSO business model is based on ultra exclusivity and a very small number of business clients. Technically, Pegasus could probably retransmit itself to infect another device, but it doesn't fit their business model so I doubt NSO would do this regularly.