If you discover a 0-day, as as software developer, you have the moral responsibility to report it to the manufacturer, not to sell it and make money off of it.
Their argument of "we're trying to stop terrorists, pedophiles etc" is the same argument as all the government organizations that are cracking down on encryption, and how bad guys can benefit from it.
NSO knows that they've fuked up, and the tone of the article clearly indicates that. They just want to plead ignorance. Hopefully they get sued and bankrupt their butts, but again they're just going to rebrand and start doing the same thing over again