"Barriers to entry"
What government cyber-agencies have been very slow to appreciate—possibly because they are, in the US particularly, run using a high proportion of military/ex-military types—is that cyber-weapons have at least one really big difference from the kind you deploy on a battelfield, and particularly in a strategic theatre of operations: the "barriers to entry" are much lower.
I'm borrowing the BTE jargon from industry because it's a half-decent fit in this case; where in context it means "cost, difficulty and time to get into the game".
The military mindset does not like the idea of your latest kit—say, a sophisticated fire-and-froget anti-radiation missile with loitering capability—falling into the enemy's hands, but you're also aware that it can and probably will happen, but also that no matter how much the enemy learns by dissecting your wayward ordnance, it's gonna take him months or years to build his own to the same standard. In general, you're expecting your technical advantage to win you the war before the enemy can catch up, even if the enemy understands that advantage—he can't replicate it fast enough.
The same is demonstrably not true of cyber-weapons. I know how to build a crude fission bomb, but even if I had some enriched uranium or plutonium in the cupboard, it would still be very hard to build a functioning, deployable weapon, especially without kiling myself in the process. Whereas, given a few gigabytes of NSA tools on a disk, I could within days start repurposing it for cunning plans and clever tricks. (If, that is, I was the kind of selfish, greedy, useless, parasitic sack of reeking shyte that writes malware. If anyone reading this is insulted by those words: oh, good.)
In short, cyber-weapons are actually a lot more like germ warheads than conventional explosives. You deploy one today, there's every chance it'll be killing people on your own doorstep next week.
I suspect that NSA in particular has been slow, no doubt fulled by some arrogance, in really understanding the dangers of this particular genie. You can be as clever as you like (yet rarely as clever as you think you are, hm?) and still, your lovingly crafted genie, once out of the bottle, is also out of your control.