The article presents an example where we basically know that it happened with Juniper Networks.
As you say, the hardware/software industries have enough difficulties with security acting on their own. They don't need the NSA purposely making more holes.
Maybe they "need" many such "holes" (which are treated as "bugs") just to make sure that if they disable some of those "holes" (because hackers/public found it out) whey still have others ready for the same purpose...
And likewise, foreign hackers and criminals may have paved the way for the NSA - which is considered a foreign hacker and criminal in other jurisdictions.