Most butterbars would know they can't do this, and would be court-martialed.
Meh, this seems marginally worse than accidentally bringing a PED into a SCIF or having some classified notes in an unmarked wheelbook. We almost never court martial people over that.
Also, the media shitstorm from the fact that it's SECDEF is significantly higher than a random butter bar that no one cares about. Without Hegseth's name, "oh my god, I found out in a Signal chat that the Navy is going to strike the Houthis today just like the U.S. said they would! More at 11!" is the most benign story in the world. And without a media shitstorm, our butter bar gets a slap on the wrist, does some extra training and pushups, and moves on with life.
It's a security breach and he shouldn't have done it. But let's realize what the proportionality is here.