[davorak]

This person would just be reporting a exploit and and getting paid for it.

They would not know about the program which takes that exploit and then gives it to the NSA.

[sliverstorm]

And why would a programmer know it was for the NSA? Just tell your underling, "We need a backdoor for <Plausible reason>"