I think what would work best is the following. NSA alerts US companies of the vulnerabilities in their products with the understanding that the companies will not publicize that the vulnerability was fixed. This will let the NSA continue to exploit the vulnerabilities; most customers never update things like routers and other obscure pieces of the infrastructure.