One of the articles you link to -- If the NSA has been hacking everything, how has nobody seen them coming? -- makes an assumption in posing the question:
"If the NSA was owning everything in sight (and by all accounts they have) then how is it that nobody ever spotted them?"
The premise for this question is incorrect, because for all we have found out about the NSA's advanced capabilities for attack, we have also found out that they are highly reluctant to use active attacks and that their internal procedures even state to stop if anything looks odd, or if signs of for example intrusion detection tools are detected. (I seem to recall Tripwire being specifically mentioned in this context somewhere.)
The NSA's modus operandi appears to be primarily passively monitoring, occasionally infiltration of juicy targets, and rarely active, simply because active attacks stand the risk of being detected. Likely even more so these days now that knowledge of the threat, if likely not anywhere near every specific attack, is out in the open. Yes, active attacks get used, but as they come with the risk of being detected and possibly even reverse-engineered (depending on the target's perceived and actual capabilities) they get used far less often than one might perhaps get the impression of.
By, as GZBK wrote, implementing a multi-layered approach to security, including mundane bugs, you also reduce the impact of a breach. And since for just about anyone mere mundane bugs are almost certainly far more likely than being hacked by the NSA and having backdoors implanted in software, this protects you against a significantly more likely threat while also providing you with a degree of protection against the less likely threat.
A tool such as a compiler or operating system is a highly complex piece of software, and standard software development processes are nowhere near as rigorous as those found for example in space hardware or aviation. The odds of a mundane bug making it into an operating system seems significantly higher than you being targetted by a nation-state level adversary. That doesn't mean to completely dismiss the possibility of nation-state level attackers, but it does mean to prioritize and implement reasonable countermeasures based on the determined threat model. Scare mongering may help a politician get reelected, but it isn't a good approach to general security.