I believe he's referring to the argument Schneier is making, not to the entire notion of NSA's SIGINT mission. Dual EC was indeed an instance of NSA harming everyone's security (less, at least in the US, than is broadly supposed, but clearly and deliberately). But it's not an instance of NSA acquiring zero-day vulnerabilities and then using them to harm everyone's security.