I think we can safely assume that, when the Snowden story broke, the NSA had no idea what documents he had taken. Even today, they may not know for certain[1] (except for the 58,000 documents David Miranda was carrying when he was detained in Heathrow). From a damage assessment perspective, all they could do is look at what he had access to, and assume that he took it all.
The first few stories that emerged were about Verizon and Prism. At that point, it looked like Snowden was whistleblowing about NSA surveillance of Americans. However, he then revealed details of NSA operations targeting Hong Kong and mainland China[2], including IP addresses[3].
At that point, it became clear that Snowden was not going to limit himself to revelations about domestic survillance, and that he had downloaded and was prepared to release details of foreign operations. If he had the IP addresses of targets, it seems plausible that he would also have information that could potentially be used to identify intelligence officers. It is probably somewhat less plausible (but still not beyond the realms of possibility) that he would have information that could be used to identify HUMINT sources (i.e. "agents").
Greenwald later said that “What motivated that leak though was a need to ingratiate himself to the people of Hong Kong and China”[4]. Snowden was later allowed to leave Hong Kong, despite an extradition request from the US[5]. Some suspect that China was able to copy the contents of the four laptops he took to Hong Kong[6].
So, from the NSA's perspective, they're dealing with a guy who stole operational details about operations against a foreign (and, from their perspective, hostile) power, and released that information "to ingratiate himself" with that foreign power.
So when, after having been stuck in Sheremetyevo Airport for more than five weeks, Snowden is granted asylum by Russia, it would not be unreasonable for the NSA to suspect the possibility of some kind of quid pro quo deal. While Putin would probably have been happy to grant Snowden asylum anyway, just to embarrass the United States, I think it's safe to assume that Putin would have sought to obtain as much advantage as possible from the situation and I, for one, can easily imagine him threatening to return Snowden to the US if he didn't cooperate.
We only have Snowden's word that he didn't share anything with the Russians (or the Chinese, for that matter) and, from the NSA's perspective, Snowden's word means nothing - as far as they're concerned, he already lied, stole and revealed sensitive information to a hostile power, so they have no reason to trust anything he says.
However, let's set Snowden's trustworthiness aside for a moment and look at how else his archive may have ended up in the hands of the Russians or Chinese.
We know that large portions (if not all) of the archive were handed over to Greenwald, Poitras and various newspapers, who wrote stories based on the information contained therein, redacting information as they saw fit. For example, the location of the GCHQ monitoring station in the Middle East was initially kept secret by the media[7] but was subsequently revealed by Duncan Campbell[8]. We also saw Guardian staff redacting slides for publication in Citizen Four.
Would foreign intelligence services (FIS) have sought to obtain a copy of the archive that was held by those reporters and newspapers? Almost certainly. Given their capabilities and resources, would a FIS have been successful in that endeavour? I would say "Probably".
It also emerged that Snowden had distributed copies of his archive (by which I mean the entire archive, not just the subset that was handed over to the journalists and newspapers) to various people so that they could be released if anything happened to him[4]. Allusions were made to it having been encrypted but, at the end of the day, the key is out there somewhere. We know that at least one of the people involved was not particularly good at operational security (c.f. David Miranda carrying the password for an encrypted file on a piece of paper[9]) and was susceptible to being pressured into giving up information under interrogation (c.f. David Miranda's disclosure of his passwords[10]).
What are the chances that other people involved, whether couriers like Miranda, or the individuals to whom Snowden distributed copies of his archive, have been identified and targeted by FIS? Given the value of the information in the archive, it seems likely that they would be prepared to devote a fair amount of resources to such an effort. Knowing what we do now (thanks to Snowden!) about the capabilities of the US and UK intelligence services, and working on the assumption that the Russian and Chinese intelligence services must possess similar capabilities, it doesn't seem to be beyond the realms of possibility that such an effort could have been successful.
So, there we have three potential "attack vectors" by which FIS could have obtained a copy of the archive: from Snowden himself, from his media partners, and from the people he gave copies to.
If you're a decision-maker at the NSA or GCHQ and you know that Snowden had access to information that could be used to identify an intelligence officer or agent, you have a choice to make: Do you assume that (a) Snowden stole that information and it has ended up in the hands of a FIS (in which case your guy is at risk), or do you hope that (b) either he didn't steal it, or that, if he did, it hasn't been acquired by a FIS?
The story in the Sunday Times suggests that they went with (a).
1: http://www.nytimes.com/2013/12/15/us/officials-say-us-may-ne...
2: http://www.scmp.com/news/hong-kong/article/1259508/edward-sn...
3: http://www.scmp.com/news/hong-kong/article/1260306/edward-sn...
4: http://www.thedailybeast.com/articles/2013/06/25/greenwald-s...
5: http://www.telegraph.co.uk/news/worldnews/northamerica/usa/1...
6: http://www.nytimes.com/2013/06/24/world/asia/china-said-to-h...
7: http://www.independent.co.uk/news/uk/politics/exclusive-uks-...
8: http://www.theregister.co.uk/2014/06/03/revealed_beyond_top_...
9: http://www.telegraph.co.uk/news/uknews/crime/10276460/David-...