The DEA does use parallel-construction, and the FBI does recruit computer security researchers for attacks (the CMU CERT attack on SR2) and hand-me-down NSA exp

The DEA does use parallel-construction, and the FBI does recruit computer security researchers for attacks (the CMU CERT attack on SR2) and hand-me-down NSA exploits (and against Tor specifically), so neither of those is remotely far-fetched. And SR1 was a priority target. We may never know what really happened; the whole Bridges/Force corruption thing, for example, is so wild no one could have dreamed it up. However, from the descriptions like Nick Bilton's article/book puffpiece, I think it's somewhat likely (and more probable than NSA tech) that Tarbell did some unauthorized (and likely illegal) personal hacking and that's the kernel of truth behind his BS 'I was just typing in some random stuff and the server spat out an IP address at me!' story - SR1 was not very securely coded. Had this come out, it would've led to some serious evidence-tainting problems for the prosecutors because it affects everything downstream: the Iceland server, the SF IP address, the Pennsylvania backups, and finally Ross's unencrypted laptop in SF.