And from everything I've seen from government policy, they actually don't want to defend because that would mean securing common software that "the enemy" also

And from everything I've seen from government policy, they actually don't want to defend because that would mean securing common software that "the enemy" also uses, closing their own avenues of attack. You can't really have an arsenal of exploits at hand without acknowledging that by keeping them secret, you're making your own people less safe.