I'm sure that's happened, but there's a reason the EQ dump included lots of vulnerabilities for Chinese products nobody in the US deploys.

"Enemy" is a weird word ("adversary" is probably better), but however you slice it: NSA's mission includes real ones.

That is entirely irrelevant to people who are still getting hacked because of these hoarded vulnerabilities.

I don't follow. Could you make this argument more specific? Who's doing this attacking? What kinds of vulnerabilities?

Stated as vaguely as you have, that's a hard argument to rebut. I tend to agree: the world would be a safer place if everything was publicly disclosed immediately. But even NSA's opponents tend not to support that as a policy objective.

Their tasking, though, is to break into foreign ones. They see breaking into domestic ones as necessary to do that (and I can see why they might feel that way, even if I don't like the result), but I don't believe it's part of their core mandate.