Well, yeah. The leaker signed an NDA. You of course take the risk that you will be punished by the NDA’s consequences that you sign unless you are using whistleblower statutes. That’s the whole point of the NDA.

Edit: you don’t publish your company’s proprietary source code and then expect you just walk away right? You’d be sued into oblivion. It’s important that people abide by their agreements. Whistleblower statutes exist to ensure protection when fraud, abuse, or other illegal activity occurs. I’m not clear if this actually meets that standard.