I imagine due to heavy and intentional compartmentalization this doesn't happen.

Perhaps it depends on the nature of the exploit. For example, I consider the weakening of Dual_EC_DRBG devilishly good: because of the chosen P and Q they knew it was weak but also were the only ones who had the key. They would definitely not tell anyone about that.

That seems to be best explanation. Two different groups with IAD being smaller one. The IAD also faces many issues with regs, red tape, Congessional mandate to use COTS garbage, lack of liability enforcement, etc. It all adds up to them getting less effective over time.

They still do some good stuff when they put their pros on it. Their Inline Media Encryptor is great. I just cloned it and expanded in one of my designs. Just compare its security features to any encrypted USB disk. You'll see high-security vs mainstream security difference.