You're referring the the "vulnerability equities process" (VEP). I haven't read anything from anyone in the field that thinks the VEP is anything but a joke. In particular, the VEP's (many) skeptics point out that you can't use a vulnerability for a little while and then arrange to have it patched, because doing so makes it likely that your adversary will discover the systems you've broken into (simply by retrospectively looking through packet logs to see instances of the exploit running).

It comes down to this: either we're going to conduct adversarial signals intelligence like other major nations do, or we're not. If we are, we're going to stockpile exploits, because that's how modern SIGINT works.

I don't know anyone in the field, in the industry or academia, that thinks it's scandalous that NSA has vulnerabilities we haven't heard about.