The thing about vulnerabilities is one single entity can't find everything. If you're then disclosing those to get everything patched you are harming your offensive capabilities. It may impact another party's offensive capabilities as well, but it's very likely they have vulnerabilities that you don't know about.
So then you have a double edged sword. Do you keep the exploit to use offensively and risk the undisclosed exploit being used against you, or disclose it and still risk another undisclosed exploit you don't know about still being used against you? Exploits are a limited resource and they expire. Once used they have an even shorter shelf life before discovery. You don't know when things will get discovered by another party as well. They need a constant influx of new vulnerabilities because the ones they have may not be useful against an assigned target tomorrow.
Your warhead, information collection, and mission ability is all determined by the offensive software you have at your disposal. Everyone else will call it malware. A reachable known target can be implanted with a non-replicating tool. These are the most covert, but also the most difficult as you may not have a direct path to the target machine. That goes into getting access to a well defended network. That requires something that spreads on it's own so it can possibly reach the machines you need coverage on. This is also a double edged sword as putting in limitations to spreading also gives away the fact it's not a random infection. Those type of tools always end up spreading to unintended places and getting examined by security researchers. If a worm component is added then you cross into the realms of epidemiology and outbreaks though without geographic isolation as a barrier. It only takes one user in a network to get infected and then it'll spread until AV and OS patches catch up.
So disclosing vulnerabilities isn't always an option if you want to remain effective offensively. It becomes a lot like a classic game theory problem The strategic choice would be to hang onto as many vulnerabilities as long as they can, and that's what everyone does.