This is on the NSA. They decided not the tell the vendors about this and that makes them responsible. They failed their task which I thought was to keep the Unites States safe and secure.
No telling how many people got copies or packet captures from its use in the YEARS it existed prior to it being patched.