This is unclear from the doc though. "Purchased" could mean they purchased the exploit from a hacking group or from the developers of the software (to keep it unsafe). Snowden'a tweet seems premature unless there are more documents showing this.