The deatils would not have to be stolen.

The unpatched exposures could have been found independently by other people during the time that they had not been reported to vendors. If one organization or person found them then so could others.

My objection is NSA et al failing to inform the Vendors.

By wanting to preserve their ability for Targeted Access they left us exposed to other types of unauthorized access using the same exploits.

Besides, they often get it wrong: 

https://theintercept.com/2016/08/14/nsa-gcsb-prism-surveillance-fullman-fiji/