Note what the actual source for that says:

> Microsoft Corp., the world's largest software company, provides intelligence agencies with information about bugs in its popular software before it publicly releases a fix, according to two people familiar with the process.

The implication being made in the gnu page is that Microsoft delays fixing bugs so that the NSA can exploit them. The source article says something slightly different though, that they inform "various" agencies prior to the patches going live. I suspect the linux kernel devs do too, or Firefox, or any number of open source projects. I'd be more surprised if none of the people on the security lists for those groups don't have a list of agencies (both US and otherwise) they send bugs to .

MSFT notifies every large costumer of security issues sometimes months in advance, the NSA don't get an exploit just a notification that a security issue has been detected, some mitigating actions they can take, sometimes an IDS/IPS signature from MSFT partners and an expected date for the fix.

Smaller business costumers (pretty much any one with a TAM) will get notification before patches are released and in some cases will get the updates prior to the normal release window on "Patch Tuesday".

Microsoft isn't the only company that does that, you can't expect businesses with 1000's of machines to be able to roll out patches on a moments notice so they share information before it becomes a Zero-Day issue for their clients.