The NSA was unable to protect its offensive crown jewels from the Shadow Brokers, and when they could not auction them off and decided to just release them in the public domain, that led to things like Wannacry or Petya that almost sank (pun intended) the world's No.1 shipping line, Maersk.

And yet those buffoons want us to trust them with master decryption keys for all encryption protocols.

With extremely valuable zero-days like this targeting is the way to go b/c you don't want the zero-day discovered by putting it out extensively in the wild. Obviously it's always a question of time anyways.

Passively collecting data on the wire is different from actively exploiting a device to execute malware. Any entity trying to work with intelligence agencies is definitely going to be careful and somewhat sparing with their use of an "S-tier" zero-day like this. (Unless they have reason to believe it's already likely been burned, in which case they might decide to hastily machine gun it while it's still viable.)

They are able to drink from the firehose, though. This is an exploit on a device rather than a nations infrastructure.

That being said Stuxnet had done its business before it went public.

This is a different context, different targeted group, different use case, than what we've seen with global NSA monitoring. You're comparing apples to oranges.