Well, to a degree. It also depends on the extent to which the NSA believes they can trust their low/mid-level analysts: after the recent incident with Snowden,

Well, to a degree. It also depends on the extent to which the NSA believes they can trust their low/mid-level analysts: after the recent incident with Snowden, I'd argue "not much". The more widely they allow such attacks to be used, the more people need know of its existence, and the greater their risk of exposure (even if the victims of these attacks are themselves oblivious). Depending on who we're imagining as the victim, you also don't necessarily have to publish at all.