Pegasus exploits were patched in iOS 9 back in 2016. How old was this guy's phone?
From the article:
"In 2017, he was arrested while reporting on a security crackdown in the Rif region, and again this past December after one of his tweets described a local judge as an “executioner.” "
So, this has been going on for awhile.