I haven’t checked, but I would guess this number even includes things like NSA outposts (since NSA is part of DoD) and embassies (which are protected by Marines).

While that may be true, if I understand correctly the typical “base” number is effectively down to a structure. So if you have a radar station in Japan that has a handful of employees and they report up to one of the larger complexes, that counts as a base. It is conflating imo with what people picture as a base.

Generally, intelligence officers/employees (such as people who work at NSA) deploy to bases, or FOBs. I'm sure there are a handful of "NSA outposts" but this isn't generally how it works.