I am generally positive on the side of TLA efforts to compromise existing software, more so if they share the vulnerabilities with those companies (basically, security testing is hard, having a government agency that tries to break software could be seen as a very useful public service)... when they hoard those exploits to use themselves I'm a bit less sympathetic and grow less and less the longer they hold off on disclosing them.

The thing I'm 100% not okay with is when TLAs use social pressure, legal pressure or traditional espionage to insure there are exploits they can exploit - this has never ended well and is always a concession in security that increases our vulnerability to bad actors. I have a modicum of trust for TLAs in the traditional espionage realms, but they have entirely burned my opinion of them when it comes to tech at this point... The NSA compromising ECC `Dual_EC_DRBG` is just a level of stupidity that demonstrates a clear lack of responsibility to civilians.