For "parallel construction" to apply, the intelligence community would have had to create the conditions in which a search authorized for some other reason would have uncovered evidence of the kernel.org rootkits.
The common example of parallel construction (because it's simple to explain, not because there's evidence it's happened) is: unauthorized electronic surveillance reveals that a drug transaction is going to happen at such-and-such corner at such-and-such time. The surveillance is shared with the police, who then station officers near the site of the transaction, and who are therefore able to observe the crime as it takes place --- giving them probable cause to effect the search themselves.
In other words, parallel construction is a way of allowing the police to be at the "right place and right time".
So, to move the ball forward on the conspiracy theory that some 27 year old doofus who rootkitted kernel.org with stolen credentials was so important to the NSA that they monitored him and conspired with the FBI to ensure he was charged, you must first come up with the set of circumstances in which the NSA could have shared something with the FBI that would have enabled FBI to de novo generate probable cause for a search.
Investigating a rootkit on kernel.org falls squarely within the NSA's counterintelligence mission. Until they investigate, they don't know whether it was done by a random 27 year old doofus or by a nation state.
