They're not always state actors, though. Sometimes it's just sociopaths who happen to be really good at compromising systems.

Also, assuming the NSA has a copy of every byte of network data ever sent through the USA, that's a LOT of data. Processing that takes time.