The CIA keeps it's own personnel records, so as I understand it, this SF86 form is a new addition to the previously hacked OPM records.

Not sure if CIA held SF86's are considered classified, but even if they are I suspect we won't see anyone, let alone a director, prosecuted for having a copy of their own "classified" employment questionnaires.