I'm not sure what specifically is being proposed here. I gave some specific examples of government actions to protect its citizens engaging in commerce going back hundreds if not thousands of years. I'm not aware of any government which has paid for doors, locks, or walls for every company in their country, I suspect any action taken by the NSA would be guided by similar restraint.

As the parent comment said, I'd like to see the NSA working to get zero day vulnerabilities fixed as opposed to hoarding them for future exploitation. At least this is my perception, to be honest aside from a few examples I've heard of I don't actually know whether I've correctly characterized their activities, they may already be doing this.

> We should regulate and punish, not subsidize.

I agree to a point, but to continue the physical-security analogy: while private businesses should not be negligent in securing their property, a patrolling police force should also exist to discourage theft and vandalism at large.

I think the private and public sector have both been negligent when it comes to cybersecurity. Both need to improve. (Like you, I'm willing to bet the private sector is hoping to sit back and let the taxpayer foot the bill for everything. This is a problem too.)