They did as much as they could but there isn't much they can do once it's out. The hacking tools exploited vulnerabilities that were inherent to Windows systems. Once they knew it was out they got Microsoft to patch it up, but that requires users to update their PCs, so hackers were still able to get into outdated systems. The WannaCry attack in 2017 used the NSA exploits.

The questionable part, I guess, is that NSA knew about these exploits but instead of warning Microsoft immediately, they used the exploits themselves until it got out into the wrong hands.