That's not really the choices available. The options aren't NSA reports bugs/uses them for intelligence collection, its NSA uses bugs for intelligence collection or they don't find bugs at all.
Its possible that the right answer is we should have a US agency finding bugs and getting them patched, but it certainly shouldn't be any of the intelligence agencies. That feels a little too like putting the military in charge of the police force.
On some authority, you're asking me to put myself in the position of an NSA leader. I'm not an NSA leader. Postponing the bug fixes hurts me, and the rest of the people like me. Fix them.