Should it be illegal? They shared a public link to a spreadsheet exposed on a .gov address. If anything, it's the owner of that .gov address that needs to get in trouble for placing sensitive documents in a publicly accessible location.
C'mon, at least RTFA before falling over yourself to support the anti-government position.