A couple of points:  1. The CIA collects spyware from other countries such as Russia and China in order to put false "finger prints" on CIA spyware to make CIA spyware look like it came from Russia or some other foreign source.  (Tell that to the Democratic National Committee who claimed that Russia hacked their computers when in fact, the CIA might have done it ).  

2. The CIA did not protect their most important spyware.  It did not "classify" that spyware.  (The CIA did not want to breach government rules for using "classified" documents and processes, so the spy tools were not classified.)  That means that the hacker community could also use those tools.  In fact, the government often employs hackers to develop its tools.  So there is a high probability that some of those tools have already been copied by hackers.  In fact, employees of the U.S. government itself have been increasingly charged with collecting information for unauthorized purposes.