Maybe the NSA can decrypt RSA or Diffie-Hellman. We don’t know. Maybe they save it for when they’ll get the keys. Another way is to saturate so much the network with spy equipment that it’s futile to search and remove it.