Eventually, the bad guys will find all of these bugs That's not really true. The NSA has incredible resources that other bad guys do not. I think a critical

Eventually, the bad guys will find all of these bugs That's not really true. The NSA has incredible resources that other bad guys do not. I think a critical step on this logic chain is "once we find all the bugs, we will be safe." Given that step, you would obviously want the NSA to tell the vendors about every single bug they find. But it's really not the case that we will ever "find all the bugs." Even if the vast resources required were needed to be spent to find all the bugs in version 3.1415, there would be new bugs in 3.1416. I can kinda-sorta buy the full-disclosure argument that "if an independent researcher can find X then so can the bad guys." That argument doesn't apply to the NSA. They have a much better reason to believe "we found this exploit, and it will take a long time for someone else to find it out."