They did as much as they could but there isn't much they can do once it's out. The hacking tools exploited vulnerabilities that were inherent to Windows systems. Once they knew it was out they got Microsoft to patch it up, but that requires users to update their PCs, so hackers were still able to get into outdated systems. The WannaCry attack in 2017 used the NSA exploits.

The questionable part, I guess, is that NSA knew about these exploits but instead of warning Microsoft immediately, they used the exploits themselves until it got out into the wrong hands.

But... what if they are decoy tools?

They did.

That doesn't mean they protected you.

Imagine you were the first country to invent a handgun. You also have the idea of making body armor, but you haven't yet because there are no handguns shooting at you.

Then someone steals your handgun. You quickly make body armor. It isn't perfect but it works really well.

Then someone 3 streets over gets shot. Because they weren't aiming at you. You have handguns. And body armor.

They'd rather go after someone exploitable.