They (and other governments) can do multiple things at the same time.

One one hand they can actively try to work with companies to get secret back doors put in, sure. But I imagine that's not usually very successful. Lavabit chose to go out of business instead of doing so... I wonder who else is out there that we don't know about.

But we also have evidence that they actively look for, buy, and hoard, unknown (to the vendor) exploits for their own possible later use in case they need it for something.

I'm sure you can imagine that it's much more advantageous to keep collecting all kinds of different ways to get into a system in case one method is not applicable for any number of reasons.