When you work for a state-actor it's no different than anywhere else; you don't have exploits coming out of the sky. You either research these vulnerabilities

When you work for a state-actor it's no different than anywhere else; you don't have exploits coming out of the sky. You either research these vulnerabilities (and you have limited capacity and knowledge) or you purchase vulnerabilities from vendors, exchanges and "research companies". In such case, it was an unnecessary free gift to an enemy state or a malicious actor. The same with NSA, they do not know all the vulns of the universe (due to budget, resources, or simply focus). You may actually have some vulns they are interested into but unless someone points these vulns to them, they will not get aware that they exists.