Non NSA employee don't know the answer. NSA employee can't answer. So I think this question will have no answer unless you join NSA.

Ghidra itself is still what they use, they released it so that potential hires don't have to be retrained from IDA Pro. What they don't release, however, is Ghidra plug-ins. I'm sure they have a vast trove of plug-ins for specific reverse engineering they do, and probably some that check for known holes they can exploit.

As far as I recall, Ghidra was in Wikileaks' 7 NSA tools from 2013. If Wikileaks got the state of the art then, it means that the NSA had around 5 years until Ghidra was released to get something better.

I don't think so. I remember reading that one reason they open-sourced it was that they didn't want to have to retrain every hacker they hired to use Ghidra instead of IDA or something else. They're probably holding stuff back, it's the NSA after all, but Ghidra is probably still their tool of choice.