Over many years, my colleagues and I were required to take an annual brief course on document and data security for federal contracts. We kept any confidential files in locked areas with number-pad door locks and file cabinets requiring keys. We had multi-layer computer security protocols for research data. I'm not talking about classified data here, but a fair amount was confidential (e.g., info on research participants). People who handle classified data go through much more training and background checks than I did.
Innocent errors or accidents can occur on a RARE basis, requiring remedy/remediation and more training. For carelessness or negligence, I've seen people lose their jobs over this. Never a prosecution, but as I said, we were not working with classified data. and I haven't seen cases of willful violation.
There is no way someone could work in the federal government for years and not know about this stuff. For willful violation, where classified or sensitive data are documents are concerned, I certainly favor prosecution and exclusion from further federal service, regardless of party or position.