The reason for mass surveillance is control of the populace. Mass surveillance clearly doesn't prevent terrorism: most of this 4th-Amendment-violating dragnet surveillance was in place well before the Boston Bombing, and nobody caught the Tsarnaevs.
So, I'm not a little torn, either: the CIA shouldn't be looking to crack iPhones, they should be looking to beef up iPhone security to keep those other nations from doing unethical stuff. Exploiting vulnerabilities for surveillance purposes is a bad thing all around. Close them holes!
I do not believe that the CIA, as it seems to exist today, is capable of doing that manner of subversion in a targeted way, they have gone rogue. I do not think that the CIA allows itself to be overseen. That part of the question is just not possible to answer.
The CIA, as it appears now, does a huge number of unethical and apparently illegal things. It appears to be beyond oversight or control. I do find it really hard to support any action by them, just as I would find it hard to support FSB or MI6 actions. The CIA appears to be a threat to civil liberties and representative democracy in the US itself right now.
But you're falling into a rhetorical trap: just because coffee is hot, you don't wait until the coffee is cold to drink it. You can judge relative degrees of hot, just as we can judge relative degrees of unethicality. It's pretty darn bad to assassinate US citizens without due process, and I'd say due process in public, whether the citizen is abroad or on homeland soil. It's pretty darn bad to torture anyone. It's less bad to attempt to crack iOS to spy on people, and it would be even less wrong to explore the exploitability of iOS. The latter may not be wrong at all. It's completely OK to analyze open source intelligence.
They were on the radar but you really can't arrest someone until they do something.
https://www.aclu.org/blog/tag/ndaa
Edit:: link for more info
I did read that link, along with many other linked pages from the original link.
See here: https://www.aclu.org/national-security/president-obama-signs...
And here: http://www.salon.com/2011/12/16/three_myths_about_the_detent...
There does seem to be a lot of debate on this topic regarding the wording of the bill and how it applies to US citizens. However, to me, the wording seems very vague and open to interpretation. Which was likely on purpose.
Edit to expand on "should be doing": at the very least, they ought to explore such vulnerabilities as a defensive measure since their counterparts in every other State are clearly doing the same thing whenever they have the capability.