Here's an article from Citizen Lab on how the Spanish government used exploits against political opponents in Catalonia:
https://citizenlab.ca/2022/04/catalangate-extensive-mercenary-spyware-operation-against-catalans-using-pegasus-candiru/
Bear in mind even police using these will almost entirely be using them against people not convicted of a crime based on suspicion.
