They are also known to hoard 0-days for years, and use some of them in their own attacks against others (such as, quite likely, Stuxnet). So, even there, the reason why they release information about some cyber threats isn't the simple fact of their existence, it is some other calculation of the effect of releasing this information.

The good part about releasing information about exploits and such is that they can be easily verified to exist, so there is no need to trust the spy agency. Any claims they make about the source of those exploits is not easily verifiable, and since you can't trust them, should be ignored.