Let's not get caught up in the word-salad headline debate and focus on the real issue.
Let me see - did I ask the Slashdot crowd for a list of topics acceptable to discuss? Hmm, nope. Thanks anyway for your unsolicited advice.
Our government, is spending our tax dollars, to find bugs in our software, and not telling us about those bugs that could be exploited and leave us vulnerable. The US government should not be allowed to silently exploit consumer or commercial software....There should be a law requiring disclosure from government entities...
About 90% of the bugs are disclosed; the other 10% remain undisclosed for some period of time while various defense and intelligence agencies use them for "cyber warfare" activities. The larger problem is not bugs that are not disclosed; it's that many of the bugs that ARE disclosed go unaddressed by the software vendors. Maybe the law you're looking for should be to require companies to notify their customers and patch the vulnerabilities within a reasonable period of time.
How do you suppose vulnerabilities find their way onto the Common Vulnerabilities and Exposures (CVE) list? The CVE is maintained by the MITRE Corporation under the oversight of U.S. CISA (Cybersecurity and Infrastructure Security Agency). The National Vulnerability Database, maintained by the National Institute of Standards and Technology (NIST) - another government agency - supports the CVE with analyses. Trenchant, the employer of the guy who stole and sold the exploits, develops "zero-day" exploits for intelligence and defense customers. You know, like the tools that were used to hack Iranian nuclear research and production facilities. There is little doubt that adversaries (and most likely allies as well) of the US are developing similar tools.