It's exactly the same in the US public service. The TLA's have been complaining about it for years and they are essentially hamstrung with defined public service salaries. It's a shitty situation for natsec operators and institutionally hard to change.

All of which has essentially led to the proliferation of greymarkets for exploits like Zerodium et al.

The situation is likely far worse for the States than the UK as the salary differential is greater and the agencies can only hire citizens. Do note that the US government is now the biggest buyer of malware on the planet, not really that surprising when you look at the circumstances.