Well, gun manufacturers have been sued in the US. Now they're protected by the Protection of Lawful Commerce in Arms Act.

But NSA is part of US DOD. So the chances of a successful claim are about zero.

Should that apply only to NSA or also to the writers of e.g. Metasploit exploits?

NSA made a weapon with the purpose of harming someone. In court, intent matters.

So: A makes a product with flaws, B makes an exploit, C leaks that exploit, D adds a harmful payload to the exploit and goes on to extort/profit from E, who has computers systems they failed to patch in time... and somehow B and only B is at fault?

FTFY: and somehow D and only D is at fault? You'll see that they'll get the blame and the rest goes free.

So does being able to enforce it. No one is going to sue the US DoD and come out winning.