I think usually the idea is you prosecute the person who steals the information, but if they pass it to another person who publishes, that person can't be prosecuted.

If the same person stole and published I'd expect they could still be prosecuted.

But others resharing it, (eg if someone posted a pastebin and others shared) would not.

In the US the distinction is made so that journalists exposing misdeeds from people in power cannot be prosecuted since the value of the information is too high for the public.