Incorrect in part. NSA hires contractors whose employees sometimes are untrustworthy, careless, and possibly clueless. In addition to Reality Leigh Winner, there also is the example of Harold Martin III, who is charged with taking home a half terabyte or so of classified program code. Neither provides a basis to disparage the code of what Martin took or that released through Shadow Brokers.
The WannaCry code, by various reports, was not well thought out including, but not limited to, the "kill switch."