Evidence was presented at trial (including chat transcripts) demonstrating that Watt supplied hacking tools and expertise knowing that he was providing individualized assistance to what was at the time the largest identity theft conspiracy ever uncovered. The getaway driver doesn't stick up the bank either, but he has approximately the same luck in sentencing. These things tend to come down to the level of intent the prosecution can establish, not just to the specific actions conspirators take.
I don't know what that says about NSO. I have no trouble believing NSO has culpability comparable to Watt's. It helps NSO that they're not generally operating under US criminal justice jurisdiction. Nothing special had to be done to convict Watt.
