Even if everybody with a brain can look at the facts and say "well that's obviously a violation of rights" the court can happily say "nope there is some minor factual delta that means that we haven't explicitly ruled on this exact circumstance so how could a cop ever know that they were violating rights?"
Because the sharing of the photos with other people wasn't established by the evidence, the court was just ruling on whether the DA had violated the plaintiffs rights by transferring the data dump from the plaintiff's phone to the sheriff, and whether that violation was obvious/established enough from prior court rulings to revoke QI. It had nothing to do with sharing the photos themselves with anyone (the DA didn't know the data dump had the photos when he shared it).
I've come across compromising data over the years--and never have I referred to it in any way that would permit identification of the person. Either it warrants going to the police or it stays private, there's no in between.