To be honest I wasn't surprised when it was revealed they done this. The phone system is SIGINT-Enabled and always was from the outset. What
did surprise me was how they went after the weak crypto and weak ciphersuites used to secure webpages. Matt Green goes into this in more detail:
https://www.youtube.com/watch?v=CKncw6mIMJQ