I'd assume they're not concerned about further leaks from this individual A.) if they've already identified him and have been monitoring him, and B.) he realizes the gravity of his situation and is spooked, resulting in him not leaking anything else since this story blew up.

It would be on other bodies (correct me if I'm wrong) to review and adjust the internal practices around the handling of confidential documents, and how this can be prevented moving forward.

Edit: Aaaaaaand he's in custody.

So once the suspect is identified, do you:

1. Swoop in and arrest them immediately

Or 2. Do comprehensive physical and electronic surveillance for say 24-72 hours to see if they try to get in contact with foreign nationals, and investigate whether they have a "dead man's switch" to release more documents?

Option 2 makes more sense to me. When cleaning this situation up it will be essential to know what he leaked and who he leaked it to. Unfortunately the NYT and Bellingcat may have forced law enforcement to move prematurely. That or friendly media got a tipoff to establish the desired narrative while the government does the "no comment during an active investigation" line.