They already do this to a certain extent. Sometimes it's after the vulnerability has already been exploited by them or a sister agency. But other times it's soon after discovery.