Probably nothing, because the actual people at NSA have remained pretty focused on their mission even absent any real technical or legislative-oversight controls. I suspect that will be the case until the hired-in-2001 people leave the agency and are replaced mainly with people trained by those post-2001 people. In the most junior roles at NSA, that's probably already happened.

I wonder if "diffuse harm happening to everyone" can ever compete with "concrete harm happening to specific people you identify with". It's clear "concrete harm happening to people about whom you give zero fucks, or actively dislike" is meaningless.

In the first category, let's go with atmospheric nuclear testing -- a small but concrete global cancer risk increase. We ended that, but only after doing it a lot, and getting most of the benefit. I'm not sure if occasional-but-universal things like car accidents (measures like airbags, etc.) count as the first or second category. The second gets a whole range of things. The third, virtually everything about warfare. All serious privacy/comsec things to date have been in the third category (unless you don't hate drug users, in which case some might be in the second category). The harm of the first category has been exceptionally minor, even if you believe humans at NSA read every single packet.