Documents marked "not for public release" aren't classified. They're what's called controlled unclassified information (CUI). It's anything from PII, law enforcement victim records to sensitive (but unclassified) technical manuals. There's dozens of categories if anyone cares to look at them: https://www.archives.gov/cui/registry/category-marking-list
They shouldn't be sitting out there, but it's also not a crime.
The first result I got was labeled "classified: top secret - not for public release" so the label is more broadly applied than just CUI. my assumption that the document was legit was wrong.