I guess you could argue the definition of "protect", but sabotaging security standards and hording security vulnerabilities is not it.
And if the rule of law require says every citizen is protected against warrant-less searches, you can not "steal" personal information about those citizens when it rest in care of a service provider.
But I take it that what is controversial is not that every national government in the civilized world needs an intelligence-gathering agency that can operate with some degree of operational secrecy. The controversy how an intelligence-gathering agency may behave.