A cynic, and, perhaps, a realist could consider their motivation to be fairly similar to that of a private blackhat attempting to purge foreign malware on hosts that they own, or may want to own. Exclusive control being always preferable to competing control.

I'd be far more impressed and grateful if these state services released disclosures and actual patches for complex zero-day vulns, particularly in unmaintained, widely deployed closed-source products such as WinXP. 8-Ball says that is 'Unlikely' though.