Washington post got former NSA TAO employees to go on record (anonymously) confirming the leaked toolkit comes from NSA:
https://www.washingtonpost.com/world/national-security/power...
https://www.washingtonpost.com/world/national-security/power...
The publicly available data would suggest that thus-far NSA-hoarded vulnerabilities are definitively known to actors who appear willing to act against US interests.
Vendor disclosure means those vulnerabilities can be patched and US interests can cease being vulnerable, but could also confirm NSA awareness of vulnerabilities - which could in turn cause attribution concerns for past or present operations the NSA is undertaking or has undertaken using these vulnerabilities (in addition to providing additional credibility to the leaker).
What a tangled web.