Finfisher was bought despite every legal expert they asked, including those they had on permanent payroll, saying it would be illegal to use. They later claimed they didn't use it only paid for the license.
They also said they'd only use a special Pegasus version that would be within the law, laws that they made and that then had to be severely limited later on by the Bundesverfassungsgericht (German constitutional court) again and again. If the government parties back then (one of which is still leading the new federal government coalition, both of which are leading different state legislators, 14 out of 16) had their way back then, things would be a lot worse.
If "they" (for various theys, as in federal government, state governments, federal/state police, intelligence services including internal ones such as the Verfassungsschutz and the MAD) actually did abide by the law is another matter E.g. they (intelligence services, in particular the BND) "helped" the US spy on German citizens including politicians via the XKeyscore program, and only admitted what was already known thanks to journalists, or even less actually, and didn't comment on anything else even when questioned by the German parliament, doing the whole "national security" yadayada or "I cannot recall".
In a day and age where government agencies write guides on how to carry out "parallel construction"[0], and after all that Snowden and others revealed, I am a bit skeptical when "they" tell the citizens that "they" only bought spyware but never used it, or only bought spyware with undisclosed modifications that allegedly made it lawful (under framework of law that indeed is of a questionable constitutionality in itself, and which had major parts struck or severely limited by courts) - a claim nobody was ever able to check thus far.
I don't see it. All states, in fact all structures of organization or governance, from states to companies to bowling leagues, seek to surveil and control as much as they can get away with. Even rinkydink little local groups, if you give them some phone app that let's them know things they had no business knowing yesterday, will happily use it.
They don't always get away with everything they want on the first try, but they always want and they always try and the acceptable standard norm always progresses only in one direction. Wins in the other direction are local wins against, not examples of some state actually deciding they don't want.