Didn't they? My understanding is this happened: * Microsoft writes codes with bugs * NSA writes exploits for said bugs and a worm based on them * ShadowBrok

Didn't they? My understanding is this happened: * Microsoft writes codes with bugs * NSA writes exploits for said bugs and a worm based on them * ShadowBrokers leak the NSA exploits and worm * Random hackers take the NSA worm and combine it with a ransomware payload So the NSA wrote the exploits and by not reporting the vulnerabilities they found they exposed the public to others finding the vulns or their findings and/or exploits leaking.