The problem with informing the companies --- and this is a positive statement not a normative one --- is that as soon as the vulnerability is broadly known, NSA's foreign targets can identify any machines NSA has instrumented using those bugs. Doing that could compromise operations in progress. And because NSA does likewise, it has to assume its adversaries have full packet captures of their most sensitive networks. Remember also that many (most?) of the tools disclosed weren't penetration tools but instead persistence tools, and that the disclose could reveal whole chains of other machines and burn additional capabilities.

I'm not saying that I personally would reach the same conclusion, just that the situation is more complex than Reuters makes it out to be.