Alas, according to statements and actions by US police forces, they do feel these types of products are legitimate for use by themselves. The way to change that is by making this illegal - there will always be suppliers so long as use is legal given how deep the police forces' warchest is.
This logic about suppliers isn't necessarily solid. Check out the difficulties for the US in continuing to execute people as European drug companies don't want to supply them with drugs for lethal injection. You can't buy drugs suitable for lethal injection over the counter, and so if an American outfit that wants to kill prisoners can't get approved to buy from a supplier then it has to resort to drastic experiments...
I feel that the demand is so large that limiting supply isn't enough in this case.
The agencies are willing to invest far more in 'breaking computer security' than in 'finding lethal injection drugs for people who are anyway in custody' . 'Breaking security' is a priority to them in the way 'finding lethal drugs' never was.
That does not get NSO Group off the hook, they did agree to work with SA in the first place - but I suspect we'll just discover there are other outfits (and inhouse talent) out there, and that lasting change requires looking also at the demand and infrastructure sides.