The NSA isn't trying to exploit everything it can find
Not trying to let them off the hook, but which is worse: 1) the CIA/NSA attacking a small number of targets with specific goals (which probably include "don't break anything so we can continue to exfiltrate data") or 2) allowing criminal gangs to run rampant who will indiscriminately attack tens of thousands of targets per year from the smallest business or municipal government to the largest, because the attacks are automated and every successful attack adds to their bottom line?