I'm pretty sure that they buy a lot of these exploits as well. If you can trust the NSA, I don't think that keeping the exploits secret is such a big deal. There are other damaging vulnerabilities that even the state actors doesn't know about and are being exploited by organized crime. It's a cat and mouse game.