Polish authorities are believed to have stopped using Pegasus in 2021, around the time the Guardian and others publicised details of the spyware, including revelations that the numbers targeted by clients were also logged by NSO Group, creating a potential security breach.
My concern is what spyware governments have been using since 2021, and how good they've gotten at covering it up in the last 3 years.