I’m curious about this statement too, seems there’s evidence that they don’t and the customer is the data handler: https://www.edps.europa.eu/system/files_en?file=2023-01/0221... top of page 4.
I guess this is all according to NSO claims. I’d like to see evidence otherwise!