People also seem to forget about major French companies like VUPEN, who research and buy 0-day vulnerabiliies with the express purpose of selling them to French

People also seem to forget about major French companies like VUPEN, who research and buy 0-day vulnerabiliies with the express purpose of selling them to French intelligence services (and intelligence services of allied countries). I have no doubt France's intelligence services are just as bad as NSA.