Aren't they literally "making us less secure" by keeping records of vulnerabilities on computer systems but not disclosing them?

This means they can't be fixed by the software company but as this data dump shows, shady characters might be able to discover these vulnerabilities by (illictly) accessing computer systems used by the NSA.

Edit: Yes the shady characters might be able to independently discover the vulnerabilities if they are not "NOBUS" but this is another avenue.