The issue here is the conflict of interest. They now have an incentive to hoard 0days instead of having a moral responsibility to responsible disclosure. We pay for them (the gov't) to discover these things, and then they fail to protect us when they know full well they exist.

IMO they should have to disclose 0days and using them between disclosure and patch is an ethical grey zone.