Company says it is not responsible for client governments' use of its spy software, but expert says that NSO controlled US servers used to access targeted users