That was the FBI talking, not the NSA (I'm the author of the article). Everything we've learned about the NSA in the last decade thanks to whistleblowers points

That was the FBI talking, not the NSA (I'm the author of the article). Everything we've learned about the NSA in the last decade thanks to whistleblowers points to widespread passive surveillance. If anything, NSA is extremely hypercautious about revealing its surveillance methods and techniques, which active attacks could do. I can envision the NSA wanting to undertake active attacks in rare situations, but we don't know whether it has the technical ability to do so under its relationship with AT&T/Verizon/etc. Also even AT&T/VZ/etc. that have historically opened their networks to the NSA for passive surveillance -- in violation of the law -- may have second thoughts if the attacks are active. I suppose you could posit the installation of devices at the target's ISP, but, again, we have no evidence this is something NSA does.