It's probably true - at least for the Information Assurance Directorate
NSA has three or four Directorates. Signals Intelligence Directorate is the spooks that everyone talks about. IT is the folks who run the computers. Information Assurance Directorate is chartered to protect American industrial and government resources - they are the anti-spooks. There may be others I don't know about - I don't follow them, I've just picked up things here and there from folks who know. IAD is probably the part of NSA that is funding the TOR project, and they have found and disclosed both bugs in crypt code in order to get it fixed, and attempted or actual penetrations to US institutions - they have saved several companies from bad things, and probably have done the same for government agencies. I think they're the ones who do the high security Linux distribution as well.
So, NSA is not one big monolithic spook-dom. It's multiple groups doing different things, and almost certainly in some cases at cross-purposes. IAD is trying to make things like TOR stronger, while the spooks are trying to break into it.