Perhaps what parent meant was that exclusive use of the code by agency would lead to easy post attack origin analysis, so by leaking the code in obfuscated form

Perhaps what parent meant was that exclusive use of the code by agency would lead to easy post attack origin analysis, so by leaking the code in obfuscated form a few other people inevitably stumble on it and use it which generates a form of cover traffic for the original agents.