What the MEPs in SEDE mean by spyware in this case is exploit and root kits being deployed by member states Interior/Home Affairs ministries and targeted at MEPs - not "mass surveillance" (which SEDE is largely indifferent about).
Spyware in EP parlance means rootkits and zero-day exploits.
This is largely a result of Predator which was co-developed in Czechia and Israel.
If that passes that's not just EU funds being misused but the EU directly mandating spyware on a continental scale!