It's my understanding that you're only required to protect the information if you've actually agreed to do so, which is obviously a retirement for being given access. Elected officials are a weird area where they have a much easier time getting clearance, but they've still made agreements to protect the information.
Trump was authorized to handle classified information in the first place, which is why his mishandling was a problem. I haven't read the actual law, but I'm pretty sure ordinary people who happen across classified information have no duty at all in any direction. If you can show me an example of a random person getting in trouble for sharing classified information that they didn't steal or get others to steal, well, let me know.
The issue becomes when things are developed with a mix of public and private money. I'm not saying we shouldn't tackle the issue, only that it can't be as simple as public money = public resource. If that were true, nearly all of us would be required to work for free, since we got the majority of our education through public funding.
Edit: It seems everyone ignored the generalization I was replying to. Yes, in terms of code it's actually relatively easy to require that a publicity funded project be open source and leave it at that. The business can decide if they want to write everything from scratch to protect their IP or if they want to open up existing code as a part of fulfilling/winning the contact.
In terms of other partially government funded projects, like the pharmaceutical example given, it's much more difficult to say how much of the process and result are thanks to public funding. That's really the only point I was trying to make, that it can get very hard to draw the line. With code, it can be relatively easy.