The tax money was spent enabling the NSA to hack into foreign computers, which is the SIGINT directorate's whole job. It sucks that their favorite bug got burned! It is a problem that it leaked, and developing a new pet bug ahead of schedule is an inefficient use of tax dollars. But NSA didn't make this bug, and it's not even unlikely that other people had it before it leaked, just in a different exploit package. Now that there's a reliable exploit attributable to NSA, everyone is going to use that one regardless.