Admittedly commenting without having jumped into the content here, but from what you're describing, it sounds less about how state actors are "breaking so much

Admittedly commenting without having jumped into the content here, but from what you're describing, it sounds less about how state actors are "breaking so much crypto" and more about how state actors are "breaking so many cryptographic implementations." This might also explain the possible shift away from compromising algorithms (with perhaps the notable exception of Dual_EC_DRBG): the IC knows well enough that everyone's going to do just enough things wrong in _implementing them_ that it's perhaps more beneficial to promote unweakened ciphers in the grand scheme. Heck they could even promote sound implementation practices and have the confidence to know any one target will gum something up just enough to give them a way in. But who knows. Odds are still decent that I'm wrong with the compromised algorithms assertion.