Well yeah, but at the same time, exfiltrating internal company data is still grounds for dismissal. It could be ethical and the Right Thing to Do, but you still crossed a boundary.

She's lost her job; if she's lucky that's the end of it. She can probably sue to get her job back or a compensation depending on whether a judge or jury rules that leaking the data served a higher purpose, but it's debatable.