About 10 years ago Israel sold Hermes drones to KSA through South Africa, that deal was pretty much openly brokered by the US because KSA wanted drones with attack capability and the US didn’t want to supply them with predator drones and the UK which is primary arms supplier to KSA didn’t had anything to export either.

Israel or not if these companies posed any actual threat to US interests yet alone national security they wouldn’t exist either through political pressure or by much stronger actions than putting them on a sanctioned list.

What will likely happen is that they’ll reform as other entities with sufficient separation from to avoid sanction or Israel would shift that capacity to some of the larger defense contractors like Elbit which the US will not sanction.

As long as there is a market for these services and there is sufficient political will in the west and the US specifically to supply “allies” with controlled offensive cyber capability there will be countries like Israel that would fulfill this demand.

The main challenge of establishing a company like NSO isn’t the human capital you can find people with the right skills pretty much anywhere it’s the connections and the government backing needed to make these deals.