It doesn't excuse all action to improve security, but we do have to occasionally align our security with modern standards. What would happen if we left all cybersecurity (including banks, power systems, etc) to the private sector?
And then, where do we draw the line? Is it okay for the FBI to target people who visit a child pornography site? Most would say yes... People who download The Anarchist's Cookbook? Probably another yes. But what about collecting info on the people who supported that whole ordeal with Clive Bundy? Or people who belong to a non-state sponsored militia? That's where the line starts to gray for many. The point being, it's never cut and dry.
There might not be a single person in the world who understands all the moving parts well enough to say what's right.
Do you stand idly by while the hostile ones (whatever that might mean) use it to their advantage, or do you get your government with their huge funds to help in this regard?
The latter, of course. Trouble is when that agency becomes rogue, which it certainly seems like the NSA have, with rubber stamping.
But we still need some form of accountable defense I think. It's just gone horribly wrong.