NSA has long had an explicit offensive and defensive mandate. They even recently created a cyber defense directorate:

https://www.washingtonpost.com/national-security/nsa-launche...

NSA has both attack and defense mandates and organizations. Currently, the attack org has priority, but it's not like the defense org does nothing. So if the attack org doesn't want a vuln, they can let the defense org reveal it for PR points.