So, they expand the program to US "ally" governments and corporations.

These entities will now give all their IP to an American company that only promises not to spy on Americans.

Subsequently, the NSA can audit the leaked sources manually and find real exploits.