[cryptarch]

Didn't they?

My understanding is this happened:

* Microsoft writes codes with bugs

* NSA writes exploits for said bugs and a worm based on them

* ShadowBrokers leak the NSA exploits and worm

* Random hackers take the NSA worm and combine it with a ransomware payload

So the NSA wrote the exploits and by not reporting the vulnerabilities they found they exposed the public to others finding the vulns or their findings and/or exploits leaking.