I think the least likely scenario, if such a thing as EternalBlue exists, is it may have been stolen or it may have been allowed to be stolen. Lesson here is never trust a spook.
On the other hand it didn't take long after the first round of Microsoft OS security breaches for Microsoft to come out and blame the NSA. Personally I think that was a public relation attempt at damage control to save face. As far as Baltimore is concerned on 14 March 2017, Microsoft issued security bulletin MS17-010. I'm dumbfounded as to why the City of Baltimore hasn't downloaded this patch. But it looks like the NSA is catching hell for it again.
disclaimer: I could be wrong