The NSA is not in charge of setting up and maintaining critical computer systems for US national security.

Contractors do that, according to DOD or DOE guidelines, which in turn means that these systems might end up using BIOS, coreboot, or something else.

The NSA itself might be using some of these systems, so its in their interest to make them secure.