Indeed, a wonderland where it is OK for a 2 trillion dollar company to take 5 years to fix vulnerabilities that put in danger many of its users worldwide.
That assumes, wrongly, that Apple only patched the vulnerabilities used by NSO since 2016 in iOS 14.8.
In reality, Apple has been reacting to and fixing new exploits all the time, with NSO Group (and others) successfully finding new ones to replace those that got patched.
For instance, the main class of NSO-related attacks has been via the Messages app and related frameworks, which were relatively poorly designed in terms of their original security architecture. Apple has since 2016 substantially hardened those subsystems, including with a new 'BlastDoor' isolation layer specifically for Messages in iOS 14. That closed off entire classes of exploits, but is clearly not perfect.
