Only 3-6% of mathematics PhDs produced in the US are hired to government positions each year, with some large portion of that going to the NSA. While that is a lot (and doesn't include the mathematicians hired straight out of bachelors and masters programs), it's minuscule compared to the total number of mathematicians produced each year world-wide ("not even a little bit"), includes many that don't work on cryptography, and is dwarfed by the external security and cryptography community, both in academia (why on earth would you exclude them?) and in business.