the NSA has always liked somewhat weak encryption. specifically, they would really like if encryption could be broken in very roughly 1 week to 1 year on a super computer.
I think lots of people have this idea that everybody thought DES was fine and so the reality of attacks on DES was astonishing, therefore AES won't be any better we're just in the dark somehow. That's just not true, DES was known to be purposefully weak, good enough but not actually good. 56-bit keys and 64-bit block sizes - you can't brute force that with a computer you can buy from the store, but it's not ludicrous and clearly somebody with government money can do it eventually. AES makes those numbers enough bigger that you just can't break it this way.