Large scale password cracking has a much clearer payoff than attacks on 1024 bit DH, which have to be targeted to individual (probably TLS) connections. The RSA that most of the Internet depends on is brokered by CAs --- so, problem 1, the USG already owns CAs and doesn't need supercomputers to get valid certificates, problem 2, the most valuable "authentic" CA signatures are 2048 bit and far outside the capabilities of an IBM supercomputer, and problem 3, even after breaking that certificate you still have to target individual TLS connections to use it.
On the other hand, you don't need the world's most powerful supercomputer to effectively crack passwords.
It's not unlikely that the simplest explanation here is just "the NSA will do whatever thing secures it the largest budget". That doesn't mean they won't use those budget-enhancing projects in ways that will shock our conscience!
Maybe protocols where the attacker has access to a signature over some data, but doesn't get access to the signed data in plaintext? Then the attacker could try to brute-force values of the signed data using the hash that forms the basis of the signature?
If you can forge the hash of a file, or the signature on that manifest, there are hundreds of different ways you can easily replace one file for another in transit over the internet.
I'd be curious if there's any older network gear that provides a hash-based rather than connection-based security model. It seems like the thing that might have seemed like a good idea to a military 40 years ago.
I'm sure it's gotten a lot tougher out there for this kind of thing since the Comodo and DigiNotar attacks. Looking forward to more mandatory CT mechanisms!
The most common attack model for this is "get ahold of a hashed password list, try to reverse as many as possible, then try to see if any has re-used those passwords on other systems". Spy agencies might be doing that too. By contrast, as Bunnie says, modern algorithms have a very large safety margin so brute-force against a random key is very implausible without some significant new algorithmic insight.
So one question is, are there significant security-sensitive deployments that are still out there of obsolete stuff with too short a keylength? 1024-bit RSA, 1024-bit DH, DES, export ciphers?
If, on the other hand, it's really mostly about password hashes, where brute force has been known to be so effective, are there any other attack contexts where the ability to reverse a password hash would be useful?