The NSA created several toolsets that involved 0-day exploits that were not reported to the vendors of software & hardware. This put in danger the safety and security of anyone using these pieces of software/hardware.
After public leaks showed the NSA found/created the security holes and the exploits were released to the public. Criminals with malicious intent created several worms and ransomware that spread across the globe causing lots of financial damage and loss.
Would the NSA be liable if anyone directly affected by these worms or ransomware wanted to sue?