NSO Group are a terrorist group for hire. This 0-click, 0-day exploit was found targeting civil society. Any one can pay to target journalists, NGOs, politicians. This is why open-source is paramount to security, and having code out in the open.
Do they make it easier for actors to perform those activities? Not sure. I was never shopping for 0-day exploits. And some argue it's similar to gun laws in US, if it's easier to buy firearms, someone is more likely to use it. I just don't buy this comparison.