I believe it’s less black and white than that - all of these organizations have both offensive and defensive priorities and sometimes choose to disclose exploit

I believe it’s less black and white than that - all of these organizations have both offensive and defensive priorities and sometimes choose to disclose exploits publicly after calculating their remaining value. See e.g. https://foreignpolicy.com/2017/09/25/is-the-nsa-doing-more-harm-than-good-in-not-disclosing-exploits-zero-days/ https://foreignpolicy.com/2017/09/25/is-the-nsa-doing-more-h... https://www.npr.org/sections/alltechconsidered/2017/11/17/564755961/government-outlines-when-it-will-disclose-or-exploit-software-vulnerabilities https://www.npr.org/sections/alltechconsidered/2017/11/17/56...