(Non-American here.) If they weren't already, it seems like private businesses, security researchers, and I suppose the general public, should start treating US government agencies as privacy and security threats, just like you'd treat any other phisher, scammer, etc.

If government agencies are compromised - via software backdoors or any other mechanism - any data and systems they can access should be considered compromised too.