This is a good point! However, the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities. There is no need for "bad publicity" to motivate them to become more secure. The CIA may even have already started working on fixes after Vault 7. Who knows?

The only thing this action serves to do is allow less than trusted third parties abuse the weapons given to them (a possibility that the speaker clearly recognizes).