I cannot say I'm surprised
There is small difference between state-backed hackers and outright global spying programme. One relies on freelance hackers, stringy budged and no judicial oversight, and the other on employed hackers with huge budget and no judicial oversight. The more important difference is that one seems focused on perceived external enemies and the other on indiscriminate spying of everyone, external or internal, enemy or not.
It would appear to me that, surprisingly, the latter approach enabled by huge budged, seems to yield worse results - due to lack of focus, perhaps. Which might be related to demonstrated severe lacks in defensive capabilities.