I believe it’s less black and white than that - all of these organizations have both offensive and defensive priorities and sometimes choose to disclose exploits publicly after calculating their remaining value. See e.g.

https://foreignpolicy.com/2017/09/25/is-the-nsa-doing-more-h...

https://www.npr.org/sections/alltechconsidered/2017/11/17/56...