I'm asumming these guys are smart enough to build something that spyware scanners can't detect. Or is my assumption wrong on that?
Pretty sure they will explicitly design the spyware so that the common scanners will not detect it at the time when the spyware is first released. But this is not only done by government agencies but by others which sell spyware - because obviously it is usually part of the expected product features that it is not easily detectable.
But once a spyware is known it is usually possible to write heuristics which can detect it so any protection against detection is only temporarily. That's why one usually limits a lot how many systems are compromised in the first place so that the chance of the spyware gets known stays low.
Would simple factory reset of a windows laptop remove any malware, if they exist?
Probably for most it would help. But it would not help in all cases or at least not for long. For example it might be possible that the target gets reinfected quickly since the router or other device in the network or some used data storage is compromised too. And if the attacker had physical access to the system the compromise might even be much deeper than what a simple factory reset would resolve.