This is really just an embarrassment for the German security services, for allowing Merkel to be spied on. I don’t approve of NSA spying, but it’s predictable that other countries (China, Russia, etc.) are going to want to spy on the EU leadership and decision making process. If the NSA is passing commercial information on to US businesses, (eg. NSA is helping Boeing win contracts against Airbus) that’s a real scandal. It’s bad faith to use an embassy to flagrantly break the laws of a host country, but US diplomats famously ignore parking tickets in London (they have over £7 million in unpaid tickets) so extending that to spying on the host nation is in keeping.
I’m not surprised that the NSA was tasked with spying on Merkel. The fact they could achieve it is an embarrassment for the Germans and for Europe only. Europe easily has the technological capability and reserves to create an surveillance-proof communication system to protect valuable communications. They should just invest prudently in improving their protocols.