Not all risks are the same. You risk death just by getting in a car on a public road. You risk being attacked by a shark if you enter the ocean.
It's important to distinguish likelihood from impact. The heavy impact is "prison"; a lighter impact is a civil suit from the SEC or a similar regulator. The likelihood is unknown right now. It probably went up the second Bloomberg published this article, so it might have been a better decision a few days ago.
The SEC seems to settle for civil penalties more often than the FBI prosecutes for jail time. Sadly, it's more likely that at least 3 managers will probably spend $200k on lawyers to navigate their statements to the authorities over the next few months.
edit The $60k profit will probably also have to defend them against lawsuits by other stockholders.
I don't know what's fair here.
How can anyone prove that they wouldn't have sold some amount of stock in the nearly 6 months since the hack started? How does a prosecutor prove intent without a very damning self-incriminating statement? Certainly $1m in stock sold at a _very_ suspicious time makes me want to blame this guy, but what if he knows he's getting laid off this week? Does that change the calculus of intent?