I suspect the CIA is doing these primitive basic attacks for one reason: they work a lot of the time. CIA likely doesn't use ONLY these attacks (and the more intricate ones are probably run by a different group), but I mean, c'mon, buffer overflows and SQL injection are STILL effective venues of attack. Why give up on something that works just because there are other, stronger, tools? This lets you reduce risk of your involved attacks being caught - use them less often. Meanwhile, you can get 80% (made up number) of your targets with "silly" stuff, and only bring out the big guns on the 20%.

All speculation, of course.