So... is he afraid of someone pirating his exploit and using it against him? If he isn't, then he's stupid.

Because that's entirely possible.

There is no such thing as a NOBUS (NObody But US) exploit. Someone else will find it - either your network will get hacked and someone will use the exploit. This is how Wannacry happened. A bunch of NSA-NOBUS exploits got leaked and sold off to people who built a ransomware tool with them. How the leak happens doesn't matter, what matters is the fact that the leak will happen. The only ethical thing to do is to disclose so that the exploit can get fixed.