Maintaining the capability to infiltrate systems by exploiting software flaws and running a dragnet surveillance state two very different things and it's perfectly possible to have either one without the other. It just so happens that in the US the NSA runs both so they tend to get conflated.