1. It is about CIA, not NSA. 2. What CIA did goes against the promise previous administration had made after Snowden leaks, where they promised that agencies will be immediately disclosing discovered vulnerabilities to the affected US tech companies.
2. Not only was such a promise never made, but it's well outside of the realm of reason. Of all the vulnerabilities out there (and the way the market works, there are more shipped every day), only small disjoint fractions have been discovered by intelligence agencies both friendly and hostile to the USIC, and hence there is absolutely no reason for them to disclose NOBUS vulns: https://en.wikipedia.org/wiki/NOBUS
2. I am not talking about all leaks ever, I am talking about the ones that CIA found. Also, NOBUS is in the domain of NSA, not CIA.
2. Makes no difference.
How do you know the CIA found these vulns, and that they weren't shared from IC partners?
You are, at best, advocating a policy which would lead to an absolutely disastrous disadvantage to the USICs SIGINT capabilities in relation to its adversaries.