This is a fine argument for not allowing NSA to help design things like key escrow, or to prevent them from involving themselves in crypto standards development. I'm not sure how it bears on vulnerability disclosure. NSA discovering and stockpiling vulnerabilities shouldn't impact other organizations discovering and then disclosing vulnerabilities.