This outlines why there's a problem with a single agency tasked with offense and defense. If you had agency tasked only with the defense of US infrastructure, it would have a clear mandate to patch zero days. Any "offensive" agency would have to deal with it doing this (just as such offensive agencies deal with zero days being patched by others).

It seems entirely reasonable to prioritize protecting US infrastructure over the possibility of a spy agency culling another nations' secret.