Clearly you're right, in the sense that, as a simple statement of fact, the NSA revelations are surprising to a great many people, maybe most people who learn of them. But there is a sense in which, when people say "this is not surprising", it implies "to people who know some things about the subject". I guess this expression, used this way, might come off as elitist or haughty, but I think it's a pretty common usage. Another reason I'm surprised at all the surprise is that I never studied cryptography, computer science, or the history of spy agencies systematically. The Puzzle Palace was a popular book, widely read, and I learned about NSA involvement in academic cryptography research by accident while studying up on numerical algorithms for physics simulations.