I mean I get it is all to help stop the bad guys, but if you are keeping cyber weapons like this. You should be required to keep them as secure and locked as possible if you don't follow responsible disclosure.
Just like how a cop would keep their weapon on them, instead of sitting it down on the table while eating lunch.
This is what scares me more than nuclear weapons. A nuke requires a huge amount of people and infrastructure to maintain and launch. But a digital weapon? Pfft, copy that shit onto a USB key and one guy can wipe out power stations across the entire country.
/s
As regards these cyberattacks, the NSA is at fault for its poor security allowing the weapons to become available to bad actors, but the mere existence or stockpiling of weapons is not the direct cause of crime. It might be more useful right now to consider who is operating these weapons, where they are firing them from, and how best to neutralize them.
tl;dr when you're under fire is not the time to worry about gun control.
I guess what's standard in the "tech world", is probably totally different in the intelligence community.
Like companies can't protect themselves, if there's no updates. There's basically no defense. Same reason I'm not a fan of nuclear power. Once you make the waste, it's hard to get rid of.
The NSA is in a very weird position because they have a task to protect the systems of the US (Information Assurance) but also to attack those of adversaries.
In this case I think they are legitimately to blame for failing to discharge their assurance duties. They've failed to properly calculate the risk of leaking the exploit and now US interests are harmed because of that failure. This is a direct result of stockpiling exploits and not exposing them to the respective software vendors. In my opinion the security of your own systems is more important the insecurity of that of your adversaries, which is why I believe that the hoarding is bad.
Also, when you're under attack it might be more useful to worry about the identity and source of your attackers than where they stole the weapons from. Weapons facilitate aggression but are not the cause thereof, and we're not the only people who know how or maintain an interest in such weapons.
Edit: My point is that thinking that requiring the NSA to keep them "as secure as possible" as though that would eliminate risk is just silly. There will always be risk of breach or insider theft, as well as the requirement that the exploits actually be put to use outside some theoretical digital lockbox. And more importantly, there will always be the risk of human error. The only way to ensure this can't happen again is to require disclosure & patching.
This case seems to show that whatever effort they're making is not sufficient.
I wonder how much of their efforts are deterred when good minded infosec persons find vulnerabilities and report them; remember Heart bleed.